harmony-platforms
Pass
Audited by Gen Agent Trust Hub on Nov 13, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill instructs the agent to ingest and analyze existing game source code to identify input logic and UI structures, creating a surface for indirect prompt injection from untrusted data.\n
- Ingestion points: Analysis of the game's input code, UI components, and existing touch/controller logic as described in the 'Order of work' in SKILL.md.\n
- Boundary markers: No specific delimiters or instructions are provided to the agent to treat the analyzed code as untrusted or to ignore embedded instructions.\n
- Capability inventory: Depending on the platform, the agent may have capabilities to write files or execute shell commands, which could be abused if the analyzed code contains malicious instructions.\n
- Sanitization: No sanitization or validation of the ingested source code is performed before analysis.\n- [DYNAMIC_EXECUTION]: The testing reference includes a JavaScript snippet that performs monkey-patching of the Gamepad API to simulate controller input during development.\n
- Evidence: The
references/testing.mdfile contains a script that redefinesnavigator.getGamepadsto return a mock controller object (fakePad), which is a form of runtime environment modification.
Audit Metadata