dayz-pbo-build
Pass
Audited by Gen Agent Trust Hub on Oct 26, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from user-provided DayZ addon folders, creating a potential surface for indirect prompt injection.
- Ingestion points: User-provided mod configuration files (config.cpp, model.cfg, stringtable.csv), scripts (.c, .cpp), and binary assets (.p3d, .rvmat) within the addon directory.
- Boundary markers: The skill instructions do not specify any delimiters or safety warnings to prevent the agent from being influenced by malicious instructions embedded in the analyzed mod files.
- Capability inventory: The skill provides instructions for executing shell commands using standard tools like AddonBuilder.exe and CfgConvert.exe, as well as several Python-based validation scripts.
- Sanitization: Although the provided scripts perform structural and syntax validation (e.g., brace counting and regex matching), they lack sanitization to prevent potential prompt injection payloads from being processed by the agent.
Audit Metadata