game-economy-balance
Pass
Audited by Gen Agent Trust Hub on Sep 5, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes game event data and metadata retrieved via the
ae-clitool. This ingestion of external data constitutes a surface for indirect prompt injection if the underlying tracking data contains adversarial content. - Ingestion points: Metadata and event reports are fetched using commands like
ae-cli analysis-meta event listandae-cli analysis report-data runas detailed in theWorkflowsection ofSKILL.md. - Boundary markers: The workflow employs confirmation cards and step-by-step guidance to ensure user oversight, though explicit text delimiters for data interpolation are not detailed.
- Capability inventory: The skill possesses the capability to execute complex analytical queries and design strategies based on the ingested data.
- Sanitization: No specific sanitization or escaping mechanisms for external event properties are described in the instructions.
- [COMMAND_EXECUTION]: The skill operates by orchestrating multiple subcommands of the
ae-clitool for data processing and report generation. - Evidence: Explicit instructions for using
ae-cli analysis report,ae-cli analysis adhoc, andae-cli analysis-metasubcommands are found inSKILL.mdunderData Acquisition Decision Rulesand throughout the analysis branches. This usage is restricted to the legitimate analytical scope of the skill.
Audit Metadata