skills/m4cs/game-creator/game-qa/Gen Agent Trust Hub

game-qa

Pass

Audited by Gen Agent Trust Hub on Apr 22, 2026

Risk Level: SAFEPROMPT_INJECTIONEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
  • [PROMPT_INJECTION]: The skill defines a render_game_to_text function to provide game state to AI agents, creating a surface for indirect prompt injection. * Ingestion points: Game state data entering the agent context via the output of window.render_game_to_text() as described in SKILL.md and iterate-client.md. * Boundary markers: No delimiters or explicit instructions to ignore embedded commands are present in the state conversion templates. * Capability inventory: The skill utilizes subprocess calls through Playwright and Node.js, file system writes for screenshots, and network operations for browser navigation. * Sanitization: No sanitization or validation logic for the game state payload is mentioned.
  • [EXTERNAL_DOWNLOADS]: The skill configuration references and installs well-known testing libraries including @playwright/test, @axe-core/playwright, and the official Playwright MCP server (@playwright/mcp). These are standard tools from trusted providers.
  • [COMMAND_EXECUTION]: The instructions involve running common development and testing commands such as npm run dev, npx playwright test, and node scripts/iterate-client.js. These commands are appropriate for a QA testing environment.
Audit Metadata
Risk Level
SAFE
Analyzed
Apr 22, 2026, 12:00 AM