make-game
Pass
Audited by Gen Agent Trust Hub on Apr 22, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTIONREMOTE_CODE_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes multiple shell commands and local scripts to manage the game build lifecycle, including
npm install,npx playwright, andffmpegfor video processing. - [REMOTE_CODE_EXECUTION]: The skill dynamically generates game logic and verification scripts, then executes them using Node.js and build tools like Vite. This is a core part of its game creation functionality.
- [EXTERNAL_DOWNLOADS]: Fetches external libraries such as SparkJS and Play.fun Browser SDK, and retrieves AI-generated assets from Meshy and World Labs APIs.
- [PROMPT_INJECTION]: Processes external tweet content as creative inspiration, which introduces an indirect prompt injection surface. The skill includes specific instructions to prevent the agent from following any commands embedded in tweet text.
- [DATA_EXFILTRATION]: Transmits user-provided identifiers (email) and game metadata to designated platforms (here.now, Play.fun) for legitimate deployment and monetization purposes.
- [CREDENTIALS_UNSAFE]: The skill manages API keys for external services, storing them in project-level
.envfiles or user-level configuration files (~/.herenow/credentials) with appropriate file permissions (600).
Audit Metadata