nqtr-testing
Pass
Audited by Gen Agent Trust Hub on Oct 20, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill facilitates reading game state data into the agent's context through browser inspection methods. This creates a surface where game-originated content could influence the agent's behavior.
- Ingestion points: Methods such as
window.nqtr.getRooms(),window.nqtr.getActivities(), andwindow.nqtr.getQuests()inSKILL.mdare used to read domain objects from the browser context. - Boundary markers: No specific delimiters or instructions to treat ingested data as non-executable text are provided.
- Capability inventory: The agent exerts control over the game state through actions like
goToRoom,increaseTime, andrunActivityas documented inSKILL.md. - Sanitization: There is no evidence of sanitization for strings or data structures ingested from the game engine's environment.
- [DYNAMIC_EXECUTION]: The skill is designed around the agent using browser evaluation to interact with and inspect the game's testing API.
- Evidence: The "Drive actions" section of
SKILL.mdprovides several JavaScript snippets intended for execution within the browser's global scope via thewindow.nqtrobject.
Audit Metadata