subnautica-ii-coop-deep-synergy-mod
Pass
Audited by Gen Agent Trust Hub on Oct 8, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The narrative engine implementation in the C# integration examples presents an indirect prompt injection surface. Data from game events and creature descriptions is passed to external AI APIs without isolation or validation.
- Ingestion points: Event descriptions and creature IDs in the NarrativeController methods.
- Boundary markers: No delimiters or instructions are used to distinguish game data from prompt instructions in the C# examples.
- Capability inventory: The skill calls OpenAI and Claude APIs and performs peer-to-peer network communication via WebRTC.
- Sanitization: Input data is not sanitized or escaped before inclusion in LLM prompts.
Audit Metadata