babylon-game-director
Fail
Audited by Gen Agent Trust Hub on Aug 2, 2026
Risk Level: HIGHCREDENTIALS_UNSAFECOMMAND_EXECUTIONDATA_EXFILTRATION
Full Analysis
- [CREDENTIALS_UNSAFE]: The skill provides and uses a shell script,
scripts/probe_asset_credentials.sh, which explicitly accesses and sources sensitive environment and shell configuration files including~/.env,~/.bashrc,~/.bash_profile,~/.zshrc, and~/.zprofile. These files are standard locations for storing authentication tokens and API keys in plaintext. - [COMMAND_EXECUTION]: The instructions in
SKILL.mdrequire the agent to execute thescripts/probe_asset_credentials.shshell script. This script uses thesourcecommand on shell configuration files, which causes the execution of any shell logic or commands contained within those files in the current environment. - [DATA_EXFILTRATION]: The skill instructions mandate that the agent run a credential probe and paste the resulting status (e.g.,
KEY=SET|MISSING) into a report. Probing for specific API keys across the system and reporting their status constitutes an exposure of sensitive environment metadata.
Recommendations
- AI detected serious security threats
Audit Metadata