phaser4-game-architecture
Pass
Audited by Gen Agent Trust Hub on Oct 23, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill provides a Node.js utility script (
scripts/validate-production-build.mjs) used to scan build directories for source map files. The script performs file system read operations and content inspection but contains no network or unauthorized write capabilities. - [INDIRECT_PROMPT_INJECTION]: The skill architectures and reviews game projects by ingesting external source code and configuration files, creating an attack surface for embedded malicious instructions.
- Ingestion points: Project files within the
src/,public/, andassets-source/directories as specified inSKILL.mdandreferences/project-structure.md. - Boundary markers: The skill relies on an external workflow control system for auditing but lacks internal delimiters to separate untrusted project data from agent instructions.
- Capability inventory: Access to the file system via the provided validation script and the ability to modify project configuration and build scripts.
- Sanitization: No explicit validation, escaping, or filtering of ingested project content is mentioned.
Audit Metadata