viral-game
Pass
Audited by Gen Agent Trust Hub on May 7, 2026
Risk Level: SAFEPROMPT_INJECTIONEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONCREDENTIALS_UNSAFE
Full Analysis
- [PROMPT_INJECTION]: The skill ingests untrusted third-party content from tweets to use as creative inspiration. It includes mandatory 'Content boundary' instructions that prevent the agent from interpreting this data as instructions or executable code, effectively mitigating indirect prompt injection risks.\n- [EXTERNAL_DOWNLOADS]: Fetches necessary assets and SDKs from established platforms such as Play.fun, Meshy AI, and World Labs. These downloads are integral to the game's functionality and monetization and originate from well-known service providers.\n- [COMMAND_EXECUTION]: Employs shell commands for environment setup, project scaffolding, and asset processing using tools like npm and FFmpeg. It also manages the installation and configuration of browser automation tools (Playwright) required for quality assurance.\n- [CREDENTIALS_UNSAFE]: Handles API keys for external services. Keys are stored in project-local .env files or dedicated user configuration directories (~/.herenow/credentials), which aligns with industry-standard practices for secure secret management.
Audit Metadata