game-qa
Pass
Audited by Gen Agent Trust Hub on Aug 24, 2026
Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill is designed to execute shell commands to launch game builds and run automated verification suites. The instructions in SKILL.md and references/qa-contract.md specify that the agent should run an 'authoritative command' to observe the game's state and capture evidence. This is a functional requirement for a QA skill and does not appear to be used for malicious purposes.
- [INDIRECT_PROMPT_INJECTION]: The skill exhibits an attack surface for indirect prompt injection because it processes external data sources like game design documents to influence its verification logic.
- Ingestion points: The agent reads external project briefs and design documents (e.g., GAME_DESIGN, PRODUCT_BRIEF) to define test assertions and checkpoints as described in SKILL.md and references/test-design-method.md.
- Boundary markers: There are no explicit instructions to use delimiters or ignore embedded instructions within the processed game design data.
- Capability inventory: The skill has shell execution capabilities used to run game builds and verify results.
- Sanitization: The skill does not mention specific sanitization or filtering of inputs from design documents before they are used to steer the QA process.
Audit Metadata