phaser-release
Pass
Audited by Gen Agent Trust Hub on Aug 28, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill provides various shell commands for game compilation (
npx tsc), automated playtesting (node), and media conversion (ffmpeg). These commands are standard for development and are designed to run within the project context using relative paths or environment variables. - [INDIRECT_PROMPT_INJECTION]: The skill describes a workflow for bug reporting where players copy their game state to the clipboard, which is then intended to be pasted into a playtest tool's
evalstep. This presents a surface for indirect prompt injection if the state data contains malicious instructions that are executed without validation. - Ingestion points: Player-generated game state JSON strings (SKILL.md, references/release-checklist.md).
- Boundary markers: No explicit delimiters or warnings for the
evalworkflow are described. - Capability inventory: Automated playtesting scripts (
playtest.mjs) used by the skill support anevalmode. - Sanitization: The skill does not provide methods for sanitizing the input state before evaluation.
- [EXTERNAL_DOWNLOADS]: The readiness checklist includes a step to verify the game by accessing the live deployment URL. While this involves a network request to an external domain, it is a routine verification step in a game release workflow.
Audit Metadata