game-qa
Warn
Audited by Gen Agent Trust Hub on Sep 21, 2026
Risk Level: MEDIUMCOMMAND_EXECUTIONDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill instructions mandate running an authoritative verify command (verify.command) to complete the test path. If the source of this command is an untrusted game build or configuration file, it could lead to arbitrary command execution on the host environment.
- [DYNAMIC_EXECUTION]: The skill supports the execution of executable models and signature commands provided within the game candidate. This allows for runtime execution of logic defined outside the skill code.
- [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from game design documents (GAME_DESIGN) and event logs to design and execute tests. Ingestion points: game design and project brief data (SKILL.md, test-design-method.md). Boundary markers: The skill notes it should only verify approved design commitments (SKILL.md), but lacks explicit delimiters for processing external text. Capability inventory: Executes shell commands via verify.command and signature_command (SKILL.md); writes to qa/verification.json (SKILL.md). Sanitization: None specified for external content.
Audit Metadata