adventure
Fail
Audited by Gen Agent Trust Hub on Feb 17, 2026
Risk Level: HIGHREMOTE_CODE_EXECUTIONCOMMAND_EXECUTION
Full Analysis
- Dynamic Execution (HIGH): The skill features an explicit compilation pipeline (defined in
events/INDEX.ymlandevents/README.md) that converts natural language expressions into executable JavaScript and Python code. This logic is used for 'runtime expressions' and 'performance systems' which evaluate generated code within the agent's environment or the browser runtime. - Command Execution (MEDIUM): According to
GLANCE.yml, the skill requiresread_file,write_file, andlist_dirtools. While intended for game-like exploration of a codebase, these capabilities allow the agent to interact with the host filesystem, creating a risk of unauthorized data modification or exposure if the agent is misled. - Indirect Prompt Injection (LOW): As a 'codebase archaeology' tool, the skill is designed to ingest untrusted data from the filesystem (files and directories). Malicious content in these files could potentially influence the 'compilation' process, leading to the generation of malicious code from seemingly benign data.
Recommendations
- AI detected serious security threats
Audit Metadata