phaser
Pass
Audited by Gen Agent Trust Hub on Oct 10, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill references and downloads packages from official registries and GitHub repositories associated with the Phaser project and well-known community libraries.
- Fetches the Phaser engine and official templates from github.com/phaserjs and npmjs.com.
- Recommends using @phaserjs/game-agent and @phaserjs/editor-mcp-server which are official tools for the ecosystem.
- References established community plugins like phaser4-rex-plugins, @esotericsoftware/spine-phaser-v4, and phaser-raycaster.
- [COMMAND_EXECUTION]: The instructions involve executing shell commands for project scaffolding, building, and running developer tools.
- Uses bun create @phaserjs/game@latest for project initialization.
- Suggests running bun run build and bunx tsc --noEmit to verify project integrity.
- Recommends running MCP servers via bunx @phaserjs/editor-mcp-server and setting up agent links with bunx @phaserjs/game-agent.
- [INDIRECT_PROMPT_INJECTION]: The skill operates on project files that could contain untrusted data, creating a potential vector for indirect prompt injection.
-
- Ingestion points: The skill reads package.json, vite.config.ts, Tiled JSON map files (level1.json), and Phaser game source code (referenced in SKILL.md and usage-guide.md).
-
- Boundary markers: There are no explicit boundary markers or warnings provided to the agent to ignore instructions embedded within these external data sources.
-
- Capability inventory: The skill possesses the capability to execute shell commands (bun, bunx), write to the file system (via scaffolding tools), and perform network operations (via package managers).
-
- Sanitization: The instructions do not specify sanitization or validation steps for the content of processed configuration or map files.
Audit Metadata