game-audio

Warn

Audited by Gen Agent Trust Hub on Mar 12, 2026

Risk Level: MEDIUMEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONPROMPT_INJECTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill recommends installing the @strudel/web package for advanced procedural background music. This package is an external dependency not included in the trusted vendors list.\n- [REMOTE_CODE_EXECUTION]: The AudioManager implementation dynamically executes functions passed to its playMusic method. This allows for flexible audio pattern generation but involves runtime execution of code generated or provided to the skill.\n- [PROMPT_INJECTION]: The skill exposes a surface for indirect prompt injection by processing external functions and string-based audio patterns.\n
  • Ingestion points: The patternFn argument in AudioManager.playMusic and the string patterns processed by parsePattern in music.js.\n
  • Boundary markers: Absent; the skill does not use delimiters to separate instructions from audio data.\n
  • Capability inventory: The skill is capable of managing browser audio contexts, oscillators, and persisting simple state to localStorage.\n
  • Sanitization: No validation or sanitization is performed on the functions or strings before they are processed by the Web Audio API.
Audit Metadata
Risk Level
MEDIUM
Analyzed
Mar 12, 2026, 07:38 AM