phaser-analyze
Pass
Audited by Gen Agent Trust Hub on Sep 14, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill invokes a local script (
scripts/analyze-project.sh) to run automated metrics scans on local game projects. Review of the script confirms it uses benign, localized commands (grep,find,wc) with no network components or privileged system commands. - [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted code and project configuration files from the user's workspace, creating an entry surface for indirect instructions hidden within code or comments.
- Ingestion points: Reads local
package.json,main.ts, and all matching.js/.tsfiles in the project workspace. - Boundary markers: Absent; files are scanned and processed directly by the agent and the shell script without isolation markers.
- Capability inventory: Includes local shell script execution (
analyze-project.sh) and multi-file text search capabilities. - Sanitization: Absent; the skill analyzes code syntax directly via regular expressions and text parsing without sandboxing text blocks.
Audit Metadata