develop-web-game
Pass
Audited by Gen Agent Trust Hub on Sep 30, 2026
Risk Level: SAFECOMMAND_EXECUTIONDYNAMIC_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes a local Node.js script (
web_game_playwright_client.js) which uses the Playwright library to automate browser interactions. This is the core mechanism for validating the web games being developed. - [DYNAMIC_EXECUTION]: The Playwright client script injects a 'Virtual Time Shim' into the target browser page using
page.addInitScript. This allows the tool to deterministically control game loops and frame timing, which is a standard and necessary practice for automated game testing. - [EXTERNAL_DOWNLOADS]: The documentation provides instructions for installing Playwright and the
@playwright/mcppackage via npm. These are legitimate dependencies required for the skill's automated testing functionality. - [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest data from
progress.mdand the content of the URL being tested. While this represents a potential attack surface for instructions embedded in data, the skill's instructions emphasize visual inspection of screenshots and text state, maintaining human-in-the-loop validation.
Audit Metadata