phaser4-game-qa-performance
Warn
Audited by Gen Agent Trust Hub on Sep 7, 2026
Risk Level: MEDIUMDYNAMIC_EXECUTIONCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [DYNAMIC_EXECUTION]: The script
scripts/responsive-visual-validation.mjsusesawait import("playwright")to dynamically load the browser automation library. It also employspage.evaluate()to execute code within the headless browser context to inspect game state and retrieve UI measurements. Additionally, thereadJsonInputfunction dynamically reads content from local filesystem paths provided via command-line arguments, which are then parsed as JSON. - [COMMAND_EXECUTION]: The skill's operational flow involves executing the
responsive-visual-validation.mjsNode.js script. This script manages automated browser processes and performs significant filesystem operations, including creating directories (fs.mkdir) and writing screenshots and JSON reports (fs.writeFile). - [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from external URLs and configuration files, creating a vulnerability surface for indirect prompt injection.
- Ingestion points: External data enters the system through the
--urlargument for site navigation and the--viewports,--contract, and--identityarguments for configuration files inscripts/responsive-visual-validation.mjs. Data is also ingested from the browser environment via the__PHASER_VISUAL_VALIDATION__hook. - Boundary markers: The script utilizes structured validation logic for UI layout contracts and checks for expected data formats like SHA-256 hashes.
- Capability inventory: The skill can navigate to arbitrary URLs, execute JavaScript in a browser context, read local files, capture screenshots, and save data to the disk.
- Sanitization: The script implements filtering for non-finite numbers (
finiteNumber), normalizes geometric objects (normalizeRect), and validates identity bindings to ensure data consistency. - [EXTERNAL_DOWNLOADS]: The skill depends on the
playwrightNode.js package, a well-known library for browser automation, to perform its primary functions.
Audit Metadata