build-game-map-editor
Pass
Audited by Gen Agent Trust Hub on Oct 29, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill defines a workflow for importing external map data drafts, which introduces a potential surface for indirect prompt injection attacks.
- Ingestion points: JSON map drafts and entity manifests imported via the editor interface as described in
SKILL.mdandreferences/vesperfall-implementation.md. - Boundary markers: The instructions emphasize strict schema validation, versioning, and explicit confirmation requirements for data-destructive actions.
- Capability inventory: The resulting application interacts with the Three.js rendering engine, writes to browser local storage, and performs file exports.
- Sanitization: Guidelines include rejecting malformed settings, out-of-bounds coordinates, and manifest mismatches during the import process.
- [COMMAND_EXECUTION]: The documentation includes instructions for running standard shell-based testing and build tools within the development environment.
- Evidence: Shell commands for
npm test,npm run build, andnode --testare specified inreferences/vesperfall-implementation.mdto verify implementation integrity.
Audit Metadata