skyrim-forge

Pass

Audited by Gen Agent Trust Hub on Oct 15, 2026

Risk Level: SAFECOMMAND_EXECUTIONDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill invokes local command-line tools and scripts to manage Skyrim modding workflows. This includes executing the forge CLI, running a local PowerShell installation script (TOOLS/Install-SkyrimForge.ps1), and utilizing a Python virtual environment for the skyrim_forge MCP server.\n- [DYNAMIC_EXECUTION]: Provides instructions to create a Python virtual environment and install the local package using pip install "<root>". This is used to ensure the automation broker runs in a stable, isolated environment.\n- [INDIRECT_PROMPT_INJECTION]: As the skill is designed to process and validate third-party Skyrim mod files (e.g., Papyrus scripts, FOMOD installers, and plugin records), it possesses an attack surface for indirect prompt injection. The skill implements significant mitigations by requiring specialized validation tools (forge-audit, fomod-validate), enforcing SHA-256 integrity checks for external executables, and prohibiting the execution of arbitrary shell commands or C# scripts within installers.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 15, 2026, 12:44 AM