phaser4-game-qa-performance

Warn

Audited by Gen Agent Trust Hub on Sep 7, 2026

Risk Level: MEDIUMDYNAMIC_EXECUTIONCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [DYNAMIC_EXECUTION]: The script scripts/responsive-visual-validation.mjs uses await import("playwright") to dynamically load the browser automation library. It also employs page.evaluate() to execute code within the headless browser context to inspect game state and retrieve UI measurements. Additionally, the readJsonInput function dynamically reads content from local filesystem paths provided via command-line arguments, which are then parsed as JSON.
  • [COMMAND_EXECUTION]: The skill's operational flow involves executing the responsive-visual-validation.mjs Node.js script. This script manages automated browser processes and performs significant filesystem operations, including creating directories (fs.mkdir) and writing screenshots and JSON reports (fs.writeFile).
  • [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from external URLs and configuration files, creating a vulnerability surface for indirect prompt injection.
  • Ingestion points: External data enters the system through the --url argument for site navigation and the --viewports, --contract, and --identity arguments for configuration files in scripts/responsive-visual-validation.mjs. Data is also ingested from the browser environment via the __PHASER_VISUAL_VALIDATION__ hook.
  • Boundary markers: The script utilizes structured validation logic for UI layout contracts and checks for expected data formats like SHA-256 hashes.
  • Capability inventory: The skill can navigate to arbitrary URLs, execute JavaScript in a browser context, read local files, capture screenshots, and save data to the disk.
  • Sanitization: The script implements filtering for non-finite numbers (finiteNumber), normalizes geometric objects (normalizeRect), and validates identity bindings to ensure data consistency.
  • [EXTERNAL_DOWNLOADS]: The skill depends on the playwright Node.js package, a well-known library for browser automation, to perform its primary functions.
Audit Metadata
Risk Level
MEDIUM
Analyzed
Sep 7, 2026, 07:46 AM
Security Audit — agent-trust-hub — phaser4-game-qa-performance