add-multiplayer

Pass

Audited by Gen Agent Trust Hub on May 2, 2026

Risk Level: SAFE
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill installs the 'partysocket' and 'partykit' packages. These are official libraries for the PartyKit platform (Cloudflare), used for managing WebSocket connections and server-side logic.
  • [COMMAND_EXECUTION]: The skill executes standard development commands including 'npm install' for dependency management and 'npx partykit deploy' for hosting the game server. These actions are transparent and necessary for the skill's primary function.
  • [INDIRECT_PROMPT_INJECTION]: The skill creates an interface that ingests data from a remote WebSocket server into the game's internal state, which is eventually serialized into the agent's context via 'render_game_to_text()'.
  • Ingestion points: WebSocket message handlers in 'src/multiplayer/MultiplayerClient.js' and 'src/systems/NetworkManager.js'.
  • Boundary markers: Not explicitly present in the generated 'render_game_to_text' extension, though the data is handled within a structured object.
  • Capability inventory: The skill's logic is limited to updating game state and rendering sprites; no dangerous capabilities like 'eval' or arbitrary command execution are used on the received data.
  • Sanitization: The server-side templates include basic validation ('isValidState') to ensure received data matches expected numeric and boolean types.
Audit Metadata
Risk Level
SAFE
Analyzed
May 2, 2026, 02:02 AM