inspect-runtime
Pass
Audited by Gen Agent Trust Hub on Oct 2, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
- [DYNAMIC_EXECUTION]: The skill instructs the agent to inject a local JavaScript file (scripts/devtools-hook.js) into the application's runtime context as an initialization script.- [INDIRECT_PROMPT_INJECTION]: The skill's primary purpose is to read data from a running PlayCanvas application.
- Ingestion points: Reads live state from the Engine inspector hook and application hierarchy (app.root.findByName, findByTag, stats, animation states) in SKILL.md.
- Boundary markers: None provided in instructions to delimit data from instructions.
- Capability inventory: The skill facilitates reading state and controlling execution flow (pausing/stepping frames via app.timeScale) in SKILL.md.
- Sanitization: No sanitization of ingested strings or identifiers is mentioned.
Audit Metadata