multiplayer-websocket

Pass

Audited by Gen Agent Trust Hub on Sep 26, 2026

Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The documentation recommends running the multiplayer server locally using npx tsx multiplayer-server.ts. This involves executing a command-line tool to bootstrap the TypeScript environment.\n- [INDIRECT_PROMPT_INJECTION]: The skill facilitates the ingestion and broadcasting of arbitrary data from external WebSocket clients, creating a surface for indirect prompt injection.\n
  • Ingestion points: The handleMessage function in reference.md accepts raw data from client connections.\n
  • Boundary markers: The provided code examples lack boundary markers or explicit instructions to the agent to ignore potentially malicious instructions embedded in the player state updates.\n
  • Capability inventory: The skill utilizes network communication (socket.send) to broadcast state to all participants and handles the persistence of player data in the server's memory.\n
  • Sanitization: The examples use JSON.parse with a type assertion (as ClientMessage) but do not implement runtime schema validation or data sanitization before processing or relaying content.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 26, 2026, 04:29 PM