build-game-monster-system
Pass
Audited by Gen Agent Trust Hub on Oct 29, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes
MonsterDefinitionobjects containing external and potentially untrusted data to perform automated audits and performance validations.\n - Ingestion points: Metadata fields such as
displayName,tags, andasset.sourcedefined in theMonsterDefinitioninterface withinreferences/monster-contract.md.\n - Boundary markers: The instructions do not define boundary markers or explicit prompts to ignore instructions that might be embedded within the asset metadata.\n
- Capability inventory: The skill uses an in-app browser for rendering visual assets and diagnostic tools for measuring performance metrics like draw calls and triangle counts, which could be exploited if malicious assets are processed.\n
- Sanitization: No sanitization or validation logic is specified to check the contents of the
MonsterDefinitionfields for malicious strings before they are processed by the agent.
Audit Metadata