build-vesperfall-review-assets
Pass
Audited by Gen Agent Trust Hub on Nov 11, 2026
Risk Level: SAFE
Full Analysis
- [COMMAND_EXECUTION]: The skill instructs the agent to run a local validation script
scripts/validate_pair.py. This script performs basic file existence checks, PNG header validation (checking dimensions and alpha channels), and file extension checks for 3D model formats. These are routine development tasks within the local project scope. - [DATA_EXPOSURE]: The workflow involves organizing assets under the
public/asset-catalog/directory, which is a standard pattern for web-accessible project assets. There are no patterns suggesting the exfiltration of credentials or sensitive system information. - [PROMPT_INJECTION]: The instructions focus on technical workflow steps and reporting requirements. No phrases attempting to bypass safety filters, override system instructions, or extract underlying model prompts were detected.
- [INDIRECT_PROMPT_INJECTION]: The skill processes project-local assets (PNG, FBX, GLB). While it ingests external file data via the
validate_pair.pyscript, the script's capabilities are strictly limited to reading file headers and checking paths. There is no execution or interpolation of untrusted data into instructions.
Audit Metadata