phaser-component-test-scenes
Pass
Audited by Gen Agent Trust Hub on Mar 18, 2026
Risk Level: SAFEPROMPT_INJECTION
Full Analysis
- [PROMPT_INJECTION]: The skill implements a 'test seam' pattern where internal component state is exposed to the global
window.__TEST__object. This creates an indirect prompt injection surface; an agent tasked with verifying components could ingest malicious instructions if the component handles untrusted data that is subsequently returned via the test seam. - Ingestion points: The agent retrieves state data using
window.__TEST__.commands.getState()as shown inassets/component-test-scene-template.ts. - Boundary markers: The instructions and templates lack explicit boundary markers or directions to treat the ingested state as untrusted data.
- Capability inventory: The recommended workflow involves browser navigation and the execution of JavaScript commands to inspect component state.
- Sanitization: No sanitization or validation logic is included in the templates for data exposed to the test seam.
Audit Metadata