harmony-publish
Pass
Audited by Gen Agent Trust Hub on Nov 13, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill includes a local validation script (check_build.mjs) that performs static analysis on web game builds. The script is designed with security in mind, including mitigations for zip path traversal and memory exhaustion (zip bombs).
- [SAFE]: The validation script sanitizes its output to prevent terminal injection attacks by stripping control characters and bidirectional overrides from file names.
- [SAFE]: The skill's instructions prioritize security best practices, such as warning against cross-site scripting (XSS) vulnerabilities and advising the agent never to handle user credentials or perform unauthorized uploads.
- [SAFE]: All operations are performed locally on the developer's build artifacts, with no detected network exfiltration or remote code execution patterns.
Audit Metadata