game-build

Pass

Audited by Gen Agent Trust Hub on Oct 7, 2026

Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
  • [INDIRECT_PROMPT_INJECTION]: The skill's logic is driven by the content of external design documents, creating a surface where malicious input could influence agent actions.
  • Ingestion points: The skill instructions require the agent to read and "compress" content from GAME_DESIGN.md, ART_DIRECTION.md, and PRODUCT_BRIEF.md to create build briefs.
  • Boundary markers: There are no explicit delimiters or sanitization steps defined to separate design data from instructional content within these files.
  • Capability inventory: The agent is empowered to execute shell commands and run Python scripts based on the parameters derived from these files.
  • Sanitization: The skill lacks explicit sanitization or validation protocols for the text ingested from the design documents before it is used to define build commands.
  • [COMMAND_EXECUTION]: The skill facilitates the execution of arbitrary shell commands as part of its core build and verification workflow.
  • Evidence: The references/build-brief-contract.md defines a schema for commands such as install, buildOrExport, start, and verify which the agent is expected to execute.
  • [DYNAMIC_EXECUTION]: The skill involves the use of dynamic scripting environments to process game assets.
  • Evidence: references/blender-asset-workflow.md specifies the use of Blender Python and CLI for scene assembly and asset modification, which involves executing Python code within the host environment.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 7, 2026, 09:38 AM