game-monetization
Pass
Audited by Gen Agent Trust Hub on Oct 18, 2026
Risk Level: SAFEPERSISTENCEINDIRECT_PROMPT_INJECTION
Full Analysis
- [PERSISTENCE]: The 'Self-evolution telemetry' section instructs the agent to write execution metadata to
~/.claude/projects/skill-telemetry.md. While used for tracking skill performance, this involves writing to a directory outside the immediate project scope to maintain state across sessions. - [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted external data (project source code) to perform its audit, creating a surface for indirect prompt injection.
- Ingestion points: Reads the codebase, SDK configurations, and store integration files (SKILL.md).
- Boundary markers: None specified; the skill does not instruct the agent to use delimiters or ignore embedded instructions within the analyzed code.
- Capability inventory: The skill instructions focus on 'reading', 'scanning', and 'identifying' but do not explicitly use shell execution tools within the instruction set provided.
- Sanitization: There is no mention of sanitizing or escaping the content read from the codebase before processing it.
Audit Metadata