pixellab
Pass
Audited by Gen Agent Trust Hub on Sep 8, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted user input through natural language fields intended for art generation descriptions.
- Ingestion points: Parameters such as
description,action_description,lower_description, andupper_descriptionacross tools inSKILL.md(e.g.,create_character,animate_character,create_topdown_tileset). - Boundary markers: Absent. The skill instructions do not provide delimiters or guidance for the agent to treat these inputs as untrusted data.
- Capability inventory: The skill grants the agent the ability to create, list, retrieve, and delete character and tile assets via the PixelLab API.
- Sanitization: No validation, filtering, or sanitization of input descriptions is defined within the skill content.
Audit Metadata