build-game-map-editor
Pass
Audited by Gen Agent Trust Hub on Sep 21, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [SAFE]: The skill defines a robust security boundary by isolating the map editor's draft document from production gameplay data and authoritative sources.- [SAFE]: Access control guidelines include hard-fail logic for missing configurations, IP allowlisting based on trusted edge headers, and secure session management using HMAC-Signed, HttpOnly, and SameSite-Strict cookies.- [INDIRECT_PROMPT_INJECTION]: The skill describes a tool that processes external JSON map documents, which presents a potential data ingestion surface. Ingestion points: Browser-based import of versioned map documents and local storage drafts as described in SKILL.md and references/vesperfall-implementation.md. Boundary markers: Explicit instructions require exact schema matching, version checks, and coordinate range limits. Capability inventory: Three.js scene rendering and inspector-based metadata editing; no command execution or network exfiltration is performed using the document content. Sanitization: Mandatory validation of entity IDs, kinds, and finite coordinate values is enforced before any processing.
Audit Metadata