pixi-vn-ink-assets
Pass
Audited by Gen Agent Trust Hub on Nov 10, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill acts as a documentation and implementation guide for the Pixi-VN framework's asset loading system. It contains no executable code or dangerous system instructions.
- [EXTERNAL_DOWNLOADS]: The skill refers to official documentation on the vendor's domain (pixi-vn.com) and demonstrates asset loading from external URLs as part of its core functionality. These references are legitimate and consistent with the skill's purpose.
- [INDIRECT_PROMPT_INJECTION]: The skill defines an interface for processing external Ink script data.
- Ingestion points: The agent reads Ink script content containing hashtag commands like
# loador# lazyload. - Boundary markers: Use of specific hashtag command tokens serves as a basic delimiter; instructions recommend restricting inputs to known identifiers to prevent silent errors.
- Capability inventory: The skill triggers PixiJS asset loading (images, audio, video); no system-level commands or file-write capabilities are involved.
- Sanitization: The
addBaseHashtagCommandsfunction allows for strict validation of asset aliases and bundle IDs against a generated list of known keys.
Audit Metadata