skyrim-plugin-authoring
Pass
Audited by Gen Agent Trust Hub on Oct 15, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill includes a PowerShell script (
scripts/run_forge_audit.ps1) designed to locate and execute theskyrim_forgePython module to perform plugin diagnostics. - [COMMAND_EXECUTION]: The test suite (
scripts/test_plugin_header_fixtures.py) uses thesubprocessmodule to execute theaudit_plugin_headers.pyscript against dynamically generated test fixtures. - [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted binary data from Skyrim plugin files and archives, which could potentially contain malicious instructions embedded in record names or metadata that are then displayed to the agent.
- Ingestion points: The
scripts/audit_plugin_headers.pyscript reads bytes from.esp,.esm, and.eslfiles, including those contained within ZIP archives. - Boundary markers: The output generated by the audit scripts is not wrapped in specific delimiters to prevent the agent from interpreting extracted strings as instructions.
- Capability inventory: The skill has the capability to execute shell commands via the
skyrim_forgewrapper script (scripts/run_forge_audit.ps1) and the test script (scripts/test_plugin_header_fixtures.py). - Sanitization: The parser extracts record signatures and master names using
latin1orcp1252decoding without sanitizing the resulting strings before printing them to the console.
Audit Metadata