nqtr-testing

Pass

Audited by Gen Agent Trust Hub on Oct 20, 2026

Risk Level: SAFEINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
  • [INDIRECT_PROMPT_INJECTION]: The skill facilitates reading game state data into the agent's context through browser inspection methods. This creates a surface where game-originated content could influence the agent's behavior.
  • Ingestion points: Methods such as window.nqtr.getRooms(), window.nqtr.getActivities(), and window.nqtr.getQuests() in SKILL.md are used to read domain objects from the browser context.
  • Boundary markers: No specific delimiters or instructions to treat ingested data as non-executable text are provided.
  • Capability inventory: The agent exerts control over the game state through actions like goToRoom, increaseTime, and runActivity as documented in SKILL.md.
  • Sanitization: There is no evidence of sanitization for strings or data structures ingested from the game engine's environment.
  • [DYNAMIC_EXECUTION]: The skill is designed around the agent using browser evaluation to interact with and inspect the game's testing API.
  • Evidence: The "Drive actions" section of SKILL.md provides several JavaScript snippets intended for execution within the browser's global scope via the window.nqtr object.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 20, 2026, 06:41 AM