generate2dmap
Pass
Audited by Gen Agent Trust Hub on Oct 7, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted user-supplied data such as game genres, map modes, and artistic styles to formulate prompts for image generation and to populate metadata files. This creates a surface where malicious instructions embedded in user input could influence the output generated by the agent.\n
- Ingestion points: User-provided parameters for game genre, map kind, and visual model defined in SKILL.md.\n
- Boundary markers: The skill lacks explicit delimiters or instructions to the agent to treat user-provided strings as untrusted or to ignore embedded commands.\n
- Capability inventory: The skill includes Python scripts (scripts/compose_layered_preview.py, scripts/extract_prop_pack.py, scripts/extract_terrain_tiles.py) that perform file system writes (saving PNG and JSON assets) and uses built-in image generation tools.\n
- Sanitization: No sanitization or validation logic is present to filter or sanitize the parameters before they are consumed for prompt engineering or file generation.
Audit Metadata