kenney-assets
Pass
Audited by Gen Agent Trust Hub on Sep 21, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill retrieves HTML content and zip archives from
kenney.nl, a reputable and well-known provider of game assets. The network operations are performed using standard Python libraries and target the official Kenney domain exclusively. - [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted web content which could serve as a vector for indirect prompt injection. 1. Ingestion points: The
searchandinspectfunctions inscripts/_kenney.pyfetch and parse HTML content. 2. Boundary markers: The skill does not implement explicit boundary markers for scraped content, though the output is structured. 3. Capability inventory: File system write capabilities are present in thedownloadfunction, which saves zip files to a user-provided directory. 4. Sanitization: HTML entities are unescaped usinghtml.unescapebefore data is returned to the agent context.
Audit Metadata