game-opportunity
Pass
Audited by Gen Agent Trust Hub on Sep 13, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill uses
child_process.spawninscripts/game-opportunity.mjsto execute local scripts and theopencliutility. This allows for data collection from social media and search engines. The implementation uses argument arrays, which prevents shell-based command injection. \n- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from game sitemaps, social media platforms (Reddit, YouTube, X), and search engine results, creating an attack surface for indirect prompt injection. \n - Ingestion points: Functions
discover,radar, andcheckUrlinscripts/game-opportunity.mjsingest raw data from external websites and APIs. \n - Boundary markers: Data is organized in JSON and Markdown, but there are no specific markers or instructions to the agent to disregard embedded commands in the processed data. \n
- Capability inventory: The skill can write to the
.rankup/directory, make external HTTP requests, and execute subprocesses usingspawninscripts/game-opportunity.mjs. \n - Sanitization: Basic sanitization is performed via
decodeHtmlandcleanPageTitleinscripts/game-opportunity.mjs, but it lacks robust safety filtering for adversarial prompt content.
Audit Metadata