colyseus-multiplayer

Pass

Audited by Gen Agent Trust Hub on Oct 7, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill provides commands for project initialization, dependency management, and execution using npm, bun, and bash. This includes scaffolding projects with npm create colyseus-app@latest, installing dependencies, and running local development servers. It also utilizes vendor-specific CLI tools: pantheon-skill-auditor for skill evaluation and rumdl for documentation linting.
  • [EXTERNAL_DOWNLOADS]: The skill initiates downloads of the Colyseus framework scaffolding tool and project dependencies from the official NPM and Bun registries. These are standard operations for the described technology stack.
  • [INDIRECT_PROMPT_INJECTION]: The skill has an indirect prompt injection surface as it is designed to ingest natural language game requirements (e.g., from the provided evaluation scenarios) and translate them into executable code.
  • Ingestion points: User-provided game logic descriptions and requirements (e.g., evals/scenario-*/task.md).
  • Boundary markers: The skill lacks explicit boundary markers or instructions to the agent to ignore embedded commands within user-provided game scenarios.
  • Capability inventory: The skill is granted Read, Write, Edit, and Bash tool access, which allows for file modification and command execution.
  • Sanitization: No explicit sanitization or validation logic is defined for the external data being processed.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 7, 2026, 10:49 AM