game-build

Warn

Audited by Gen Agent Trust Hub on Aug 27, 2026

Risk Level: MEDIUMCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill is designed to identify and instruct the execution of shell commands for installation, building, and verification (e.g., install, buildOrExport, start, verify) defined within a generated BUILD_BRIEF.md. These commands are determined dynamically based on the project's design and runtime environment.
  • [INDIRECT_PROMPT_INJECTION]: The skill processes content from untrusted external documents like GAME_DESIGN.md, ART_DIRECTION.md, and PRODUCT_BRIEF.md to determine the build toolchain and execution logic. A malicious design document could influence the generated shell commands.
  • Ingestion points: GAME_DESIGN.md, ART_DIRECTION.md, PRODUCT_BRIEF.md (specified in SKILL.md and references/build-brief-contract.md).
  • Boundary markers: None identified in the provided contracts to isolate instructions within these documents.
  • Capability inventory: Execution of shell commands through the commands section in build-brief-contract.md.
  • Sanitization: The skill instructions do not specify validation or sanitization of the commands extracted or derived from the design documents.
  • [DYNAMIC_EXECUTION]: The skill involves runtime generation of execution paths and build scripts. It uses a "signature command" pattern to validate inputs, but the ultimate output is the execution of a candidate build within the target runtime environment.
Audit Metadata
Risk Level
MEDIUM
Analyzed
Aug 27, 2026, 03:21 AM
Security Audit — agent-trust-hub — game-build