harvest-game
Pass
Audited by Gen Agent Trust Hub on Jul 11, 2026
Risk Level: SAFEPROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection. It processes untrusted external data from web searches and user-provided URLs to guide its research and code generation phases.
- Ingestion points: Target game links (repositories or game pages) and web research results (SKILL.md).
- Boundary markers: Absent. The instructions lack explicit warnings to the agent to ignore instructions embedded in the external content.
- Capability inventory: File system writes to the
Games/directory, shell command execution viabunandvite, and GitHub repository management including creating and merging pull requests. - Sanitization: Absent. External content is used directly to define game mechanics and systems without filtering.
- [COMMAND_EXECUTION]: The skill performs standard development operations using the
bunruntime. - Evidence: Use of
bun run check-types,bun test, andvitefor building and verifying the generated game slices.
Audit Metadata