steam
Pass
Audited by Gen Agent Trust Hub on Jun 20, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill documentation and metadata specify the installation of the
steam-games-clipackage from the official NPM registry. - [COMMAND_EXECUTION]: The skill operates by executing the
steamCLI tool to perform library queries and profile lookups. - [SAFE]: Indirect Prompt Injection Risk Assessment:
- Ingestion points: The skill fetches game titles, tags, and reviews from the Steam API (e.g., via
steam library --json). - Boundary markers: None identified; game data is processed directly as JSON.
- Capability inventory: The agent has the capability to execute shell commands (specifically the
steamtool). - Sanitization: No explicit sanitization of game-related metadata is mentioned, though risk is minimal for this use case.
Audit Metadata