harmony-make
Pass
Audited by Gen Agent Trust Hub on Nov 6, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process untrusted user input (game ideas and interview responses) to generate design documents and source code.
- Ingestion points: Phase 1 (Interview) processes user responses based on templates in references/interview.md.
- Boundary markers: Decisions are captured in a structured design brief (docs/design.md) requiring explicit developer approval before any code is written.
- Capability inventory: The skill manages project scaffolding and code generation using tools like Vite. It includes explicit prohibitions against using dangerous functions like eval or innerHTML for external data.
- Sanitization: The skill mandates using textContent and fillText for displaying external data and requires type, length, and value validation for saves and imported files.
Audit Metadata