harmony-engines

Pass

Audited by Gen Agent Trust Hub on Nov 13, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill instructs the agent to help the developer configure their game to load the official Harmony SDK from https://cdn.playharmony.ai/v1/loader.js. This is a legitimate vendor-owned resource required for the bridge functionality.
  • [INDIRECT_PROMPT_INJECTION]: The skill defines a process for the agent to read project configuration files to identify the game engine and version.
  • Ingestion points: ProjectSettings/ProjectVersion.txt (Unity) and project.godot (Godot).
  • Boundary markers: Absent; the agent reads specific paths.
  • Capability inventory: The skill enables the agent to generate and write C#, GDScript, and JavaScript bridge files into the user's project directory.
  • Sanitization: The skill provides strong defensive guidance, including a displayText function that strips control/zero-width characters and explicit warnings against using eval or Application.ExternalEval on untrusted data.
Audit Metadata
Risk Level
SAFE
Analyzed
Nov 13, 2026, 02:51 AM