game-build
Warn
Audited by Gen Agent Trust Hub on Aug 27, 2026
Risk Level: MEDIUMCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill is designed to identify and instruct the execution of shell commands for installation, building, and verification (e.g.,
install,buildOrExport,start,verify) defined within a generatedBUILD_BRIEF.md. These commands are determined dynamically based on the project's design and runtime environment. - [INDIRECT_PROMPT_INJECTION]: The skill processes content from untrusted external documents like
GAME_DESIGN.md,ART_DIRECTION.md, andPRODUCT_BRIEF.mdto determine the build toolchain and execution logic. A malicious design document could influence the generated shell commands. - Ingestion points:
GAME_DESIGN.md,ART_DIRECTION.md,PRODUCT_BRIEF.md(specified inSKILL.mdandreferences/build-brief-contract.md). - Boundary markers: None identified in the provided contracts to isolate instructions within these documents.
- Capability inventory: Execution of shell commands through the
commandssection inbuild-brief-contract.md. - Sanitization: The skill instructions do not specify validation or sanitization of the commands extracted or derived from the design documents.
- [DYNAMIC_EXECUTION]: The skill involves runtime generation of execution paths and build scripts. It uses a "signature command" pattern to validate inputs, but the ultimate output is the execution of a candidate build within the target runtime environment.
Audit Metadata