quick-game
Pass
Audited by Gen Agent Trust Hub on May 8, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes
npm install,npm run dev, andnpm run buildwithin the scaffolded game directory to initialize and test the project. - [EXTERNAL_DOWNLOADS]: Fetches game inspiration from external Twitter/X URLs via the
fetch-tweettool. - [EXTERNAL_DOWNLOADS]: Downloads project dependencies from the NPM registry during the scaffold process.
- [PROMPT_INJECTION]: Potential for indirect prompt injection as game concepts are derived from external tweet content and passed to a subagent for implementation.
- Ingestion points: Tweet content fetched from external URLs (SKILL.md).
- Boundary markers: None specified for the subagent
Taskinstructions. - Capability inventory: File system access, shell execution, and subagent task creation across all scripts.
- Sanitization: No sanitization of tweet content is mentioned before it influences code generation.
Audit Metadata