phaser

Pass

Audited by Gen Agent Trust Hub on Oct 10, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill references and downloads packages from official registries and GitHub repositories associated with the Phaser project and well-known community libraries.
  • Fetches the Phaser engine and official templates from github.com/phaserjs and npmjs.com.
  • Recommends using @phaserjs/game-agent and @phaserjs/editor-mcp-server which are official tools for the ecosystem.
  • References established community plugins like phaser4-rex-plugins, @esotericsoftware/spine-phaser-v4, and phaser-raycaster.
  • [COMMAND_EXECUTION]: The instructions involve executing shell commands for project scaffolding, building, and running developer tools.
  • Uses bun create @phaserjs/game@latest for project initialization.
  • Suggests running bun run build and bunx tsc --noEmit to verify project integrity.
  • Recommends running MCP servers via bunx @phaserjs/editor-mcp-server and setting up agent links with bunx @phaserjs/game-agent.
  • [INDIRECT_PROMPT_INJECTION]: The skill operates on project files that could contain untrusted data, creating a potential vector for indirect prompt injection.
    1. Ingestion points: The skill reads package.json, vite.config.ts, Tiled JSON map files (level1.json), and Phaser game source code (referenced in SKILL.md and usage-guide.md).
    1. Boundary markers: There are no explicit boundary markers or warnings provided to the agent to ignore instructions embedded within these external data sources.
    1. Capability inventory: The skill possesses the capability to execute shell commands (bun, bunx), write to the file system (via scaffolding tools), and perform network operations (via package managers).
    1. Sanitization: The instructions do not specify sanitization or validation steps for the content of processed configuration or map files.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 10, 2026, 07:46 PM