opengame-browser-game-builder
Pass
Audited by Gen Agent Trust Hub on Sep 1, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [SAFE]: The skill incorporates strong defensive guidelines in
SKILL.md, specifically instructing the agent to never embed credentials, private prompts, internal URLs, customer content, analytics, cookies, or local absolute paths in the generated output. - [INDIRECT_PROMPT_INJECTION]: The skill is designed to process untrusted user input (game ideas) to generate executable JavaScript and HTML code, which presents a potential attack surface for prompt injection.
- Ingestion points: User-provided game concepts and descriptions processed according to instructions in
SKILL.md. - Boundary markers: There are no specific delimiters or instruction overrides defined to isolate user-provided data from the agent's core instructions.
- Capability inventory: The skill generates browser-executable code using Canvas, DOM, SVG, or Three.js and can modify files within the target project's toolchain.
- Sanitization: The provided instructions do not include specific validation or sanitization steps for the game concepts provided by the user.
Audit Metadata