tinyworld-island-and-planes
Pass
Audited by Gen Agent Trust Hub on Oct 29, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes data that could act as a vector for indirect instructions, specifically through banner messages and layout configurations.
- Ingestion points: The
BANNER_MESSAGESsource used for towed banners and island coordinate/layout parameters defined in the skill logic. - Boundary markers: No specific delimiters or safety warnings for embedded instructions are mentioned for the processed strings.
- Capability inventory: The skill interacts with the DOM to set logo-adjacent banners and writes to the world-history snapshot via
serializeEditableIslands(). - Sanitization: The instructions do not specify sanitization or escaping protocols for the content of the
BANNER_MESSAGES. - [EXTERNAL_DOWNLOADS]: The skill includes a reference to an external social media platform for a sponsor link.
- Evidence: Mentions a clickable link to
https://x.com/Autoincentiv3. This reference targets a well-known service and is used for standard social media redirection.
Audit Metadata