level-design
Pass
Audited by Gen Agent Trust Hub on Mar 23, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill is intended for static analysis of game development projects. It evaluates logic, algorithms, and design heuristics without executing the target codebase or downloading external dependencies.
- [PROMPT_INJECTION]: Indirect Prompt Injection Surface: The skill analyzes untrusted data from the local project codebase (e.g., scripts, JSON/CSV data, level files). While this presents a surface for instructions embedded in data to influence the agent, the risk is mitigated by explicit instructions forbidding code modification.
- Ingestion points: Local codebase files identified during Phase 1 (TMX, JSON, scripts, etc.).
- Boundary markers: None explicitly defined.
- Capability inventory: Analysis and investigation; code modification is explicitly prohibited.
- Sanitization: None described.
- [PROMPT_INJECTION]: The instructions command the agent to "Do NOT ask the user questions" and "Investigate the codebase thoroughly." This increases the agent's autonomy for the audit task but is a functional requirement rather than a malicious safety bypass.
- [SAFE]: The skill includes a "Self-Evolution Telemetry" section that writes execution metadata to
~/.claude/projects/skill-telemetry.md. This is a platform-specific logging mechanism for performance tracking and does not involve exfiltration to external domains or unauthorized persistence.
Audit Metadata