game-build
Pass
Audited by Gen Agent Trust Hub on Oct 7, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill's logic is driven by the content of external design documents, creating a surface where malicious input could influence agent actions.
- Ingestion points: The skill instructions require the agent to read and "compress" content from
GAME_DESIGN.md,ART_DIRECTION.md, andPRODUCT_BRIEF.mdto create build briefs. - Boundary markers: There are no explicit delimiters or sanitization steps defined to separate design data from instructional content within these files.
- Capability inventory: The agent is empowered to execute shell commands and run Python scripts based on the parameters derived from these files.
- Sanitization: The skill lacks explicit sanitization or validation protocols for the text ingested from the design documents before it is used to define build commands.
- [COMMAND_EXECUTION]: The skill facilitates the execution of arbitrary shell commands as part of its core build and verification workflow.
- Evidence: The
references/build-brief-contract.mddefines a schema for commands such asinstall,buildOrExport,start, andverifywhich the agent is expected to execute. - [DYNAMIC_EXECUTION]: The skill involves the use of dynamic scripting environments to process game assets.
- Evidence:
references/blender-asset-workflow.mdspecifies the use of Blender Python and CLI for scene assembly and asset modification, which involves executing Python code within the host environment.
Audit Metadata