vibe-game-workflow
Pass
Audited by Gen Agent Trust Hub on Aug 24, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill directs the agent to execute various shell commands for project development, building, and deployment using
npm,vite,vercel, andpartykit.- [INDIRECT_PROMPT_INJECTION]: The skill has an attack surface where it ingests external data to drive its behavior. - Ingestion points: The workflow relies on reading instructions from
docs/PRD.mdand GitHub issues to generate project code. - Boundary markers: There are no explicit instructions or delimiters to prevent the agent from following malicious commands embedded in these documents.
- Capability inventory: The skill utilizes file writing for scaffolding and shell execution for deployment.
- Sanitization: No sanitization steps are defined for the data ingested from documentation or issue trackers.- [EXTERNAL_DOWNLOADS]: The workflow incorporates resources from well-known services and the vendor's infrastructure.
- Utilizes the
@shipshitgames/enginepackage, a library provided by the skill author. - Guides deployment to official platforms like Vercel and PartyKit.
Audit Metadata