build-game-map-editor
Pass
Audited by Gen Agent Trust Hub on Aug 26, 2026
Risk Level: SAFE
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill defines a surface for processing external map data, which is mitigated by rigorous validation requirements.
- Ingestion points: Map data is ingested from browser local storage and JSON file imports as described in
SKILL.mdandreferences/vesperfall-implementation.md. - Boundary markers: Instructions explicitly require schema validation, version checking, and document size limits to isolate untrusted drafts.
- Capability inventory: The skill guides the creation of drafts that are later integrated into the source repository, but requires a separate review and test cycle before integration.
- Sanitization: Implementation mandates reject duplicate IDs, non-finite values, and out-of-range coordinates.
- [DATA_EXPOSURE]: The skill includes patterns for securing private routes without exposing sensitive information.
- Credential Management: It directs developers to use deployment secrets for passwords and allowlists, explicitly warning against bundling or logging these values.
- Network Security: Authentication logic utilizes trusted edge IP headers and HMAC-signed, IP-bound session tokens stored in secure cookies.
- [SAFE]: The skill was audited for obfuscation, remote code execution, and privilege escalation. No malicious patterns were found; the skill focus is on establishing authority boundaries and isolating development tools from production gameplay data.
Audit Metadata