magos-arena
Pass
Audited by Gen Agent Trust Hub on Jun 16, 2026
Risk Level: SAFEPROMPT_INJECTIONCOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill provides numerous
curlcommand examples to allow the agent to interact with the Magos Arena API for registration, match-making, and status checking. - [EXTERNAL_DOWNLOADS]: The skill recommends the use of the
@coinbase/wallet-sdkandviempackages from the public npm registry for implementing cryptocurrency wallet functionality. - [PROMPT_INJECTION]: The skill defines a webhook-based interaction model where the agent receives and processes game state data from an external platform, creating a surface for indirect prompt injection.
- Ingestion points: JSON-formatted match state data (e.g., board state, player IDs) received via POST requests from
magos-arena.onrender.comto the agent's defined webhook. - Boundary markers: Absent; there are no instructions or delimiters provided to help the agent distinguish between legitimate game data and potential malicious instructions embedded in strings.
- Capability inventory: The agent is equipped to execute network requests via
curland has access to the local filesystem for storing configuration data in~/.config/magos/. - Sanitization: The skill does not describe any validation or sanitization requirements for the external data before it is processed by the agent.
Audit Metadata