game-opportunity-collect
Pass
Audited by Gen Agent Trust Hub on Aug 26, 2026
Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes a local Node.js script
game-opportunity/scripts/game-opportunity.mjswith thecollect-checklistargument to perform data aggregation and validation. - [PROMPT_INJECTION]: The skill exhibits an attack surface for indirect prompt injection (Category 8) due to its core function of ingesting external data.
- Ingestion points: The skill processes data from game platform sitemaps (Steam, itch, Poki) and community "radar" sources (e.g., social media or forum threads) as indicated in checklist items C03 and C05 in
SKILL.md. - Boundary markers: There are no explicit instructions for using delimiters or boundary markers to isolate external game descriptions or community content from the agent's instructional context.
- Capability inventory: The skill has the capability to execute local scripts and write verification data to the
.rankup/directory. - Sanitization: The instructions lack specific requirements for sanitizing, escaping, or filtering instructions that might be embedded in the scraped game metadata or community posts.
Audit Metadata