skills/egorfedorov/slot-casino-game-developer-skills-for-stake-engine/stake-game-developer/Gen Agent Trust Hub
stake-game-developer
Pass
Audited by Gen Agent Trust Hub on Sep 21, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill exhibits an indirect prompt injection surface as it is designed to ingest and process external project files, game indices, and event streams for validation.\n
- Ingestion points:
scripts/audit-checklist.mjs(scans specified target directories),scripts/validate-books-index.mjs(reads index JSON artifacts), andscripts/validate-rgs-events.mjs(parses event JSONL files).\n - Boundary markers: Absent; the scripts read file contents directly for pattern matching and structural validation.\n
- Capability inventory: Minimal risk as the provided scripts only perform read operations (
fs.readFileSync) and diagnostic reporting via stdout. No network exfiltration, file system writes, or subprocess execution capabilities are included.\n - Sanitization: The scripts perform structural validation (JSON parsing) and keyword checks without sanitizing inputs, but since the output is only diagnostic text, the impact is negligible.\n- [SAFE]: The documentation for currency scaling (1,000,000 for API, 100 for Books) and compliance terminology (e.g., replacing 'bet' with 'play' for social jurisdictions) follows standard gaming industry best practices and contains no malicious instructions.\n- [SAFE]: All JavaScript utilities (
.mjsfiles) use only native Node.js modules (node:fs,node:path) and do not attempt to download external packages or execute remote code.
Audit Metadata