quick-game
Warn
Audited by Gen Agent Trust Hub on Apr 22, 2026
Risk Level: MEDIUMCOMMAND_EXECUTIONEXTERNAL_DOWNLOADSCREDENTIALS_UNSAFEPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes shell commands including
npm install,npm run dev, andnpm run buildin a newly created project directory. - [EXTERNAL_DOWNLOADS]: The skill uses a
fetch-tweetskill to download content from external social media platforms and performsnpm installwhich downloads dependencies from the public npm registry. - [CREDENTIALS_UNSAFE]: The skill requests and stores a
MESHY_API_KEYfrom the user for 3D asset generation. - [PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection by fetching content from tweets and using it to generate game logic via a subagent without sanitization. Ingestion point: Tweet URLs in SKILL.md. Boundary markers: Absent. Capability inventory: npm execution and file writes in SKILL.md. Sanitization: Absent.
Audit Metadata