openrive-verify-animation
Pass
Audited by Gen Agent Trust Hub on Oct 6, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill instructs the agent to execute shell commands for validating animation assets and running host project maintenance tasks such as
bun run cli validate,bun run test, andbun run build. - [INDIRECT_PROMPT_INJECTION]: The skill defines a process where the agent ingests and acts upon data extracted from external animation files.
- Ingestion points: Metadata from local
.rivfiles is ingested through the output of thebun run cli infocommand and theinspect_rivtool (SKILL.md). - Boundary markers: There are no instructions provided to the agent to use delimiters or ignore potentially malicious instructions embedded within the asset metadata.
- Capability inventory: The skill provides the agent with the ability to execute shell commands and interact with the local development environment (SKILL.md).
- Sanitization: The skill does not include steps for the agent to sanitize or validate the external data before it is incorporated into the prompt context.
Audit Metadata