se-dev-mod
Pass
Audited by Gen Agent Trust Hub on Apr 30, 2026
Risk Level: SAFE
Full Analysis
- [PROMPT_INJECTION]: No attempts to override agent behavior, bypass safety filters, or extract system prompts were detected in the instructions.
- [DATA_EXFILTRATION]: No unauthorized network activity or harvesting of sensitive files (credentials, SSH keys) was found. The skill accesses standard game and user directories (e.g., %AppData%, %USERPROFILE%) solely for the purpose of mod indexing as documented.
- [REMOTE_CODE_EXECUTION]: The skill downloads and installs 'uv' from astral.sh and 'busybox' from frippery.org during the preparation phase. Both are standard developer tools from well-known and reputable sources. No execution of arbitrary scripts from untrusted origins was observed.
- [COMMAND_EXECUTION]: Allowed commands are limited to environment setup, code indexing, and search operations using local scripts and established utilities.
- [OBFUSCATION]: No hidden commands, encoded payloads (Base64), or deceptive character usage (homoglyphs, zero-width) were found in the prose or code.
- [INDIRECT_PROMPT_INJECTION]: While the skill processes external mod code, the analysis is performed via static symbol extraction using tree-sitter, which does not execute the processed content. The output is formatted and presented as search results.
Audit Metadata