duel-game-core
Pass
Audited by Gen Agent Trust Hub on Oct 8, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted natural language input (game rules) provided by users to generate Motoko and JavaScript source code.
- Ingestion points: Game rules provided in the user prompt as instructions for code generation.
- Boundary markers: The skill does not define strict delimiters for input, but provides a sanitization helper
esc()in the frontend template to manage variables from the game state. - Capability inventory: Deployment involves shell access for
npm,mops,git, and the Internet ComputericpCLI tools. - Sanitization: The
plugin.js.templateusesesc()for rendering text to mitigate Cross-Site Scripting (XSS) risks in generated clients. - [EXTERNAL_DOWNLOADS]: Fetches framework logic from the vendor's official GitHub repository and installs dependencies from public npm and mops registries.
- [COMMAND_EXECUTION]: Provides the agent with a workflow to execute shell commands for repository cloning, package management, unit testing, and canister deployment.
Audit Metadata