harmony-sdk
Pass
Audited by Gen Agent Trust Hub on Nov 13, 2026
Risk Level: SAFE
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill references official SDK packages and loader scripts from the vendor's CDN. These are legitimate resources for the Harmony platform. Evidence: References to @playharmony/sdk and https://cdn.playharmony.ai/v1/loader.js.
- [INDIRECT_PROMPT_INJECTION]: The skill identifies that the SDK handles untrusted player data and provides explicit security rules for sanitization to prevent injection attacks. Evidence: 1. Ingestion points: Data entering through harmony.auth, harmony.friends, and harmony.files (SKILL.md). 2. Boundary markers: Guidance in references/showing-text.md to use text-only rendering components. 3. Capability inventory: File system access and user identity access. 4. Sanitization: Mandatory use of textContent and forLabel filtering (references/showing-text.md).
Audit Metadata