pokemon-player

Pass

Audited by Gen Agent Trust Hub on Sep 23, 2026

Risk Level: SAFE
Full Analysis
  • [COMMAND_EXECUTION]: The skill starts a local background server using the pokemon-agent serve command. This is standard functionality for providing the game state and processing actions within the terminal.
  • [EXTERNAL_DOWNLOADS]: The instructions guide the user to install the pokemon-agent and pyboy packages via pip. These are required libraries for the skill's gaming purpose.
  • [REMOTE_CODE_EXECUTION]: An automated alert flagged the piping of output to python3. Manual analysis confirms the command is python3 -m json.tool, which is a safe, standard module used exclusively for pretty-printing JSON data for readability.
  • [INDIRECT_PROMPT_INJECTION]: The skill consumes external data (game state and collision maps) to drive agent logic. This ingestion surface is well-defined and constrained to the local server, representing a low-risk, intended implementation for gameplay automation.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 23, 2026, 11:28 PM