multiplayer
Pass
Audited by Gen Agent Trust Hub on Sep 28, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill creates a mechanism for ingesting real-time data from external players, which establishes an attack surface for indirect prompt injection. If an AI agent processes this player-controlled data without additional filtering, it could be influenced by malicious instructions embedded in game states or events.
- Ingestion points: Data enters via
MultiplayerClient.players,MultiplayerClient.sharedState, andonEventhandlers as described inSKILL.mdandreferences/react.md. - Boundary markers: The framework provides logical separation between player state, shared state, and event messages, although it does not implement specific prompt-protection delimiters by default.
- Capability inventory: The skill maintains an active network connection to the party host and provides tools for deployment via the
vibedgamesCLI. - Sanitization: The party server includes a built-in guard that prevents prototype pollution by dropping any state patches containing keys such as
__proto__orconstructor. - [EXTERNAL_DOWNLOADS]: The skill requires the installation of the
@vibedgames/multiplayerpackage and utilizes thevibedgamesCLI tool. These are resources provided by the skill author's infrastructure.
Audit Metadata