skills/m4cs/game-creator/quick-game/Gen Agent Trust Hub

quick-game

Warn

Audited by Gen Agent Trust Hub on Apr 22, 2026

Risk Level: MEDIUMCOMMAND_EXECUTIONEXTERNAL_DOWNLOADSCREDENTIALS_UNSAFEPROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill executes shell commands including npm install, npm run dev, and npm run build in a newly created project directory.
  • [EXTERNAL_DOWNLOADS]: The skill uses a fetch-tweet skill to download content from external social media platforms and performs npm install which downloads dependencies from the public npm registry.
  • [CREDENTIALS_UNSAFE]: The skill requests and stores a MESHY_API_KEY from the user for 3D asset generation.
  • [PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection by fetching content from tweets and using it to generate game logic via a subagent without sanitization. Ingestion point: Tweet URLs in SKILL.md. Boundary markers: Absent. Capability inventory: npm execution and file writes in SKILL.md. Sanitization: Absent.
Audit Metadata
Risk Level
MEDIUM
Analyzed
Apr 22, 2026, 12:00 AM