build-live-game
Pass
Audited by Gen Agent Trust Hub on Oct 27, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill documents architectural patterns for ingesting data from external services such as Remote Config and Cloud Save (e.g., in
references/achievements.mdandreferences/battlepass.md). This creates a risk surface where malicious data stored in these services could attempt to influence the agent's behavior. - Ingestion points:
RemoteConfigService.Instance.FetchConfigsAsyncandCloudSaveService.Instance.Data.Player.LoadAsyncare used to retrieve game definitions and player progress records from UGS. - Boundary markers: The provided code and instructions do not include explicit delimitation or "ignore embedded instructions" warnings for the agent when processing data from these services.
- Capability inventory: The skill enables the management of player data, deployment of cloud resource files (.rc, .ac, .ccmr), and interaction with UGS admin APIs.
- Sanitization: The blueprint provides strong structural security by enforcing server-authoritative logic (via Cloud Code) and Access Control policies to restrict data access and mutation.
Audit Metadata