game-audio
Warn
Audited by Gen Agent Trust Hub on Mar 12, 2026
Risk Level: MEDIUMEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONPROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill recommends installing the
@strudel/webpackage for advanced procedural background music. This package is an external dependency not included in the trusted vendors list.\n- [REMOTE_CODE_EXECUTION]: TheAudioManagerimplementation dynamically executes functions passed to itsplayMusicmethod. This allows for flexible audio pattern generation but involves runtime execution of code generated or provided to the skill.\n- [PROMPT_INJECTION]: The skill exposes a surface for indirect prompt injection by processing external functions and string-based audio patterns.\n - Ingestion points: The
patternFnargument inAudioManager.playMusicand the string patterns processed byparsePatterninmusic.js.\n - Boundary markers: Absent; the skill does not use delimiters to separate instructions from audio data.\n
- Capability inventory: The skill is capable of managing browser audio contexts, oscillators, and persisting simple state to
localStorage.\n - Sanitization: No validation or sanitization is performed on the functions or strings before they are processed by the Web Audio API.
Audit Metadata