phaser4-game-release
Pass
Audited by Gen Agent Trust Hub on Oct 17, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process untrusted external data which creates a potential attack surface for indirect prompt injection instructions embedded within project metadata or manifests.\n
- Ingestion points: External data enters the agent context through 'Work Items', platform matrices, resource registries, and test plans as specified in the SKILL.md file.\n
- Boundary markers: There are no explicit delimiters or instructions provided to the agent to ignore or isolate instructions that may be embedded within these external documents.\n
- Capability inventory: The workflow includes capabilities for performing builds, uploading artifacts, and configuring backend/channel settings (e.g., phaser-build-upload, phaser-backend-config, phaser-channel-config).\n
- Sanitization: The skill lacks explicit instructions for sanitizing, escaping, or validating the content of external project data before processing.
Audit Metadata