phaser-architect

Pass

Audited by Gen Agent Trust Hub on Sep 14, 2026

Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
  • [INDIRECT_PROMPT_INJECTION]: The skill ingests external project files which presents a potential surface for indirect prompt injection attacks.
  • Ingestion points: Evaluates user-provided project documentation such as docs/GDD.md, along with source files like src/main.ts, src/scenes/**/*.ts, and src/objects/**/*.ts inside SKILL.md and references/agent-guidance.md.
  • Boundary markers: Absent. No specialized delimiters or explicit instructions are provided to insulate the agent's core directive from text contained within the analyzed files.
  • Capability inventory: Uses file-system and workspace analysis tools (Read, Glob, Grep) to inspect user codebases.
  • Sanitization: Absent. No validation or parsing constraints are detailed for the incoming file contents.
  • [COMMAND_EXECUTION]: The guidance specifies running a development-phase playtest harness command (node "${CLAUDE_PLUGIN_ROOT}/skills/phaser-playtest/scripts/playtest.mjs" --project .) to verify build states under the development workflow section of references/agent-guidance.md.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 14, 2026, 10:08 PM