phaser-architect
Pass
Audited by Gen Agent Trust Hub on Sep 14, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill ingests external project files which presents a potential surface for indirect prompt injection attacks.
- Ingestion points: Evaluates user-provided project documentation such as
docs/GDD.md, along with source files likesrc/main.ts,src/scenes/**/*.ts, andsrc/objects/**/*.tsinsideSKILL.mdandreferences/agent-guidance.md. - Boundary markers: Absent. No specialized delimiters or explicit instructions are provided to insulate the agent's core directive from text contained within the analyzed files.
- Capability inventory: Uses file-system and workspace analysis tools (
Read,Glob,Grep) to inspect user codebases. - Sanitization: Absent. No validation or parsing constraints are detailed for the incoming file contents.
- [COMMAND_EXECUTION]: The guidance specifies running a development-phase playtest harness command (
node "${CLAUDE_PLUGIN_ROOT}/skills/phaser-playtest/scripts/playtest.mjs" --project .) to verify build states under the development workflow section ofreferences/agent-guidance.md.
Audit Metadata