partykit-multiplayer
Pass
Audited by Gen Agent Trust Hub on Aug 24, 2026
Risk Level: SAFE
Full Analysis
- [COMMAND_EXECUTION]: The skill defines standard npm scripts for development (
vite,partykit dev) and deployment (partykit deploy). No dangerous or hidden command executions were identified. - [DATA_EXFILTRATION]: Communication is restricted to game state synchronization via WebSockets (PartyKit). There is no evidence of the skill accessing sensitive environment variables, SSH keys, or cloud credentials for exfiltration purposes.
- [REMOTE_CODE_EXECUTION]: The skill utilizes legitimate libraries (
partysocket,partykit) and deployment workflows for Cloudflare Workers. It does not download or execute arbitrary scripts from untrusted external URLs. - [PROMPT_INJECTION]: The instructions are strictly technical and architectural, focusing on game engine implementation. There are no attempts to manipulate agent behavior or bypass safety guardrails.
- [INDIRECT_PROMPT_INJECTION]: The skill handles untrusted user input (player names, move claims) but explicitly includes robust sanitization patterns, such as string slicing for names and type coercion/validation for numerical state, which mitigates injection risks at the application level.
Audit Metadata