colyseus-multiplayer
Pass
Audited by Gen Agent Trust Hub on Oct 7, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill provides commands for project initialization, dependency management, and execution using
npm,bun, andbash. This includes scaffolding projects withnpm create colyseus-app@latest, installing dependencies, and running local development servers. It also utilizes vendor-specific CLI tools:pantheon-skill-auditorfor skill evaluation andrumdlfor documentation linting. - [EXTERNAL_DOWNLOADS]: The skill initiates downloads of the Colyseus framework scaffolding tool and project dependencies from the official NPM and Bun registries. These are standard operations for the described technology stack.
- [INDIRECT_PROMPT_INJECTION]: The skill has an indirect prompt injection surface as it is designed to ingest natural language game requirements (e.g., from the provided evaluation scenarios) and translate them into executable code.
- Ingestion points: User-provided game logic descriptions and requirements (e.g.,
evals/scenario-*/task.md). - Boundary markers: The skill lacks explicit boundary markers or instructions to the agent to ignore embedded commands within user-provided game scenarios.
- Capability inventory: The skill is granted
Read,Write,Edit, andBashtool access, which allows for file modification and command execution. - Sanitization: No explicit sanitization or validation logic is defined for the external data being processed.
Audit Metadata