phaser-playtest
Pass
Audited by Gen Agent Trust Hub on Aug 28, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill executes local developer tools such as
npm,npx, andnodeto build and test the project. These are standard development operations restricted to the local project environment. - [EXTERNAL_DOWNLOADS]: The skill requires
playwrightto be installed. It provides instructions to download the Playwright browser binaries vianpx playwright install chromium. This targets a well-known service (Microsoft/Playwright) for its primary functionality. - [INDIRECT_PROMPT_INJECTION]: The skill ingests scenario files (
.mjs) and evaluates expressions within a headless browser context. However, this is used for testing the developer's own code, and the tool is intended for manual execution by the developer rather than processing untrusted third-party data. - [DYNAMIC_EXECUTION]: The harness uses
page.evaluate()to run JavaScript inside the browser context to probe the game state. This is a standard and necessary method for headless browser testing and does not incorporate untrusted external input.
Audit Metadata