multiplayer

Pass

Audited by Gen Agent Trust Hub on Sep 28, 2026

Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [INDIRECT_PROMPT_INJECTION]: The skill creates a mechanism for ingesting real-time data from external players, which establishes an attack surface for indirect prompt injection. If an AI agent processes this player-controlled data without additional filtering, it could be influenced by malicious instructions embedded in game states or events.
  • Ingestion points: Data enters via MultiplayerClient.players, MultiplayerClient.sharedState, and onEvent handlers as described in SKILL.md and references/react.md.
  • Boundary markers: The framework provides logical separation between player state, shared state, and event messages, although it does not implement specific prompt-protection delimiters by default.
  • Capability inventory: The skill maintains an active network connection to the party host and provides tools for deployment via the vibedgames CLI.
  • Sanitization: The party server includes a built-in guard that prevents prototype pollution by dropping any state patches containing keys such as __proto__ or constructor.
  • [EXTERNAL_DOWNLOADS]: The skill requires the installation of the @vibedgames/multiplayer package and utilizes the vibedgames CLI tool. These are resources provided by the skill author's infrastructure.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 28, 2026, 12:18 PM