dayz-modding
Pass
Audited by Gen Agent Trust Hub on Sep 22, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill exhibits an indirect prompt injection attack surface as it is designed to process and modify user-supplied DayZ mod files (.c, config.cpp, types.xml, etc.).
- Ingestion points: The agent ingests external data when reading DayZ mod source files, configuration files, and UI layouts to perform analysis or generate code, as described in
SKILL.md. - Boundary markers: The instructions do not define specific delimiters or 'ignore embedded instructions' warnings when processing user-provided code files.
- Capability inventory: The skill generates code utilizing engine APIs for file system operations (
JsonFileLoader), network communication (ScriptRPC), and UI manipulation (Widgetsystem). - Sanitization: There is no explicit requirement for the agent to sanitize or escape user-provided strings before they are interpolated into generated mod scripts or configurations.
- Assessment: While the attack surface exists, this is characteristic of a coding assistant skill. The skill mitigates risk by explicitly instructing the agent in
references/architecture.mdandSKILL.mdto not fetch external content or wikis at runtime and to rely solely on the provided local reference files.
Audit Metadata