phaser4-game-ui-layout
Pass
Audited by Gen Agent Trust Hub on Sep 7, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill manages an ingestion surface by processing external layout contracts in JSON/YAML format.
- Ingestion points: The
loadContractfunction inscripts/validate_ui_layout_contract.mjsreads contract files from the local project directory. - Sanitization: Strict schema validation is performed by the
validateContractfunction, and data is parsed using standard methods to minimize injection risks. - Capability inventory: The validation script is limited to local file system reads and cryptographic hashing; it lacks network access or write capabilities.
- [COMMAND_EXECUTION]: The documentation instructs the agent to execute local Node.js scripts for layout validation.
- Security Features: A
projectPathutility is implemented to prevent directory traversal attacks, ensuring that file operations are confined to the intended project root.
Audit Metadata