skyrim-forge
Pass
Audited by Gen Agent Trust Hub on Oct 15, 2026
Risk Level: SAFECOMMAND_EXECUTIONDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill invokes local command-line tools and scripts to manage Skyrim modding workflows. This includes executing the
forgeCLI, running a local PowerShell installation script (TOOLS/Install-SkyrimForge.ps1), and utilizing a Python virtual environment for theskyrim_forgeMCP server.\n- [DYNAMIC_EXECUTION]: Provides instructions to create a Python virtual environment and install the local package usingpip install "<root>". This is used to ensure the automation broker runs in a stable, isolated environment.\n- [INDIRECT_PROMPT_INJECTION]: As the skill is designed to process and validate third-party Skyrim mod files (e.g., Papyrus scripts, FOMOD installers, and plugin records), it possesses an attack surface for indirect prompt injection. The skill implements significant mitigations by requiring specialized validation tools (forge-audit,fomod-validate), enforcing SHA-256 integrity checks for external executables, and prohibiting the execution of arbitrary shell commands or C# scripts within installers.
Audit Metadata