harvest-full-game
Pass
Audited by Gen Agent Trust Hub on Jul 11, 2026
Risk Level: SAFE
Full Analysis
- [COMMAND_EXECUTION]: The skill executes project-specific commands using the
bunruntime for type-checking, automated testing, and UI verification (e.g.,bun run check-types,bun test,bun run shoot). It also references the use ofviteas a development server for the generated games. These commands are consistent with the skill's stated purpose of software development. - [EXTERNAL_DOWNLOADS]: The skill utilizes web research to gather information regarding game mechanics, loops, and features. This involves making external network requests to research targets. This behavior is a core component of the intended game research workflow.
- [PROMPT_INJECTION]: The skill possesses an indirect prompt injection surface (Category 8) because it processes untrusted data sourced from the web during the research phase.
- Ingestion points: Web research results describing game mechanics, systems, and controls are ingested into the agent's context.
- Boundary markers: The instructions do not specify explicit delimiters or isolation techniques for the data retrieved during the research step.
- Capability inventory: The agent has the ability to write to the file system, execute terminal commands, and perform repository management tasks (creating and merging PRs) via GitHub MCP tools.
- Sanitization: There are no documented mechanisms for validating or sanitizing the content retrieved from web searches before it is used to influence the game building process.
Audit Metadata