pixi-vn-ink-assets

Pass

Audited by Gen Agent Trust Hub on Nov 10, 2026

Risk Level: SAFE
Full Analysis
  • [SAFE]: The skill acts as a documentation and implementation guide for the Pixi-VN framework's asset loading system. It contains no executable code or dangerous system instructions.
  • [EXTERNAL_DOWNLOADS]: The skill refers to official documentation on the vendor's domain (pixi-vn.com) and demonstrates asset loading from external URLs as part of its core functionality. These references are legitimate and consistent with the skill's purpose.
  • [INDIRECT_PROMPT_INJECTION]: The skill defines an interface for processing external Ink script data.
  • Ingestion points: The agent reads Ink script content containing hashtag commands like # load or # lazyload.
  • Boundary markers: Use of specific hashtag command tokens serves as a basic delimiter; instructions recommend restricting inputs to known identifiers to prevent silent errors.
  • Capability inventory: The skill triggers PixiJS asset loading (images, audio, video); no system-level commands or file-write capabilities are involved.
  • Sanitization: The addBaseHashtagCommands function allows for strict validation of asset aliases and bundle IDs against a generated list of known keys.
Audit Metadata
Risk Level
SAFE
Analyzed
Nov 10, 2026, 05:33 AM