monetize-game
Pass
Audited by Gen Agent Trust Hub on Apr 22, 2026
Risk Level: SAFECOMMAND_EXECUTIONDATA_EXFILTRATIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes shell commands for authentication, project discovery, and deployment. This includes running internal skill scripts ('playfun-auth.js') and standard development tools like 'git', 'gh', 'npm', and 'npx'.
- [DATA_EXFILTRATION]: The skill transmits game metadata (title, description, and public URL) to the Play.fun API ('api.play.fun') to register the game. This network activity is the primary intended function of the skill.
- [EXTERNAL_DOWNLOADS]: The skill integrates a remote JavaScript SDK ('https://sdk.play.fun/latest') into the project's HTML templates to enable monetization features at runtime.
- [PROMPT_INJECTION]: The skill exhibits an indirect prompt injection surface by ingesting data from local project files.
- Ingestion points: Project configuration files ('package.json', 'vite.config.js') and source code.
- Boundary markers: None present.
- Capability inventory: Shell command execution, file system modification, and network access.
- Sanitization: None identified for ingested file content.
Audit Metadata