phaser-release

Pass

Audited by Gen Agent Trust Hub on Aug 28, 2026

Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [COMMAND_EXECUTION]: The skill provides various shell commands for game compilation (npx tsc), automated playtesting (node), and media conversion (ffmpeg). These commands are standard for development and are designed to run within the project context using relative paths or environment variables.
  • [INDIRECT_PROMPT_INJECTION]: The skill describes a workflow for bug reporting where players copy their game state to the clipboard, which is then intended to be pasted into a playtest tool's eval step. This presents a surface for indirect prompt injection if the state data contains malicious instructions that are executed without validation.
  • Ingestion points: Player-generated game state JSON strings (SKILL.md, references/release-checklist.md).
  • Boundary markers: No explicit delimiters or warnings for the eval workflow are described.
  • Capability inventory: Automated playtesting scripts (playtest.mjs) used by the skill support an eval mode.
  • Sanitization: The skill does not provide methods for sanitizing the input state before evaluation.
  • [EXTERNAL_DOWNLOADS]: The readiness checklist includes a step to verify the game by accessing the live deployment URL. While this involves a network request to an external domain, it is a routine verification step in a game release workflow.
Audit Metadata
Risk Level
SAFE
Analyzed
Aug 28, 2026, 07:01 AM
Security Audit — agent-trust-hub — phaser-release