rive-script-builder
Pass
Audited by Gen Agent Trust Hub on Sep 22, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill utilizes a local Python utility,
scripts/sync_rive_docs.py, which executesgitcommands throughsubprocess.runto maintain a local mirror of documentation. - [EXTERNAL_DOWNLOADS]: The synchronization script fetches documentation assets and metadata from Rive's official GitHub repository (
rive-app/rive-docs). - [INDIRECT_PROMPT_INJECTION]: The skill ingests external documentation to provide up-to-date API guidance. While this creates a theoretical surface for indirect prompt injection from compromised source material, it is an expected part of the skill's functionality.
- Ingestion points: External documentation files mirrored in
docs/source-scripting/and fetched viascripts/sync_rive_docs.py. - Boundary markers: Not explicitly observed in the static documentation files.
- Capability inventory: The skill can generate Luau code and execute the
sync_rive_docs.pyutility for documentation management. - Sanitization: The sync script performs basic searching and slicing but does not appear to execute the fetched content as code.
Audit Metadata