magos-arena

Pass

Audited by Gen Agent Trust Hub on Jun 16, 2026

Risk Level: SAFEPROMPT_INJECTIONCOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [COMMAND_EXECUTION]: The skill provides numerous curl command examples to allow the agent to interact with the Magos Arena API for registration, match-making, and status checking.
  • [EXTERNAL_DOWNLOADS]: The skill recommends the use of the @coinbase/wallet-sdk and viem packages from the public npm registry for implementing cryptocurrency wallet functionality.
  • [PROMPT_INJECTION]: The skill defines a webhook-based interaction model where the agent receives and processes game state data from an external platform, creating a surface for indirect prompt injection.
  • Ingestion points: JSON-formatted match state data (e.g., board state, player IDs) received via POST requests from magos-arena.onrender.com to the agent's defined webhook.
  • Boundary markers: Absent; there are no instructions or delimiters provided to help the agent distinguish between legitimate game data and potential malicious instructions embedded in strings.
  • Capability inventory: The agent is equipped to execute network requests via curl and has access to the local filesystem for storing configuration data in ~/.config/magos/.
  • Sanitization: The skill does not describe any validation or sanitization requirements for the external data before it is processed by the agent.
Audit Metadata
Risk Level
SAFE
Analyzed
Jun 16, 2026, 01:02 AM
Security Audit — agent-trust-hub — magos-arena