pixi-vn-canvas
Pass
Audited by Gen Agent Trust Hub on Nov 10, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill references several external packages and assets required for game development.
- Fetches spritesheet data from
pixijs.com, the official domain for the PixiJS project. - References official documentation and asset repositories on
pixi-vn.comand GitHub under theDRincs-Productionsorganization. - [COMMAND_EXECUTION]: Includes standard terminal commands for installing development dependencies using the NPM package manager.
- Example:
npm install --save-dev @assetpack/core @drincs/assetpack-plugin-aseprite. These are routine developer operations for building game assets. - [INDIRECT_PROMPT_INJECTION]: The skill describes a surface for processing game assets (aliases and URLs) which could theoretically serve as an attack vector if processing untrusted data.
- Ingestion points: Asset manifests (AssetPack) and remote URLs provided to functions like
showImageorAssets.add(found inSKILL.md). - Boundary markers: None explicitly defined in the documentation; the system relies on standard PixiJS asset loading isolation.
- Capability inventory: The skill allows for the rendering of images, playback of video files, and execution of frame-based animations (found in
SKILL.md). - Sanitization: Relies on the security model of the underlying PixiJS and browser rendering engines.
Audit Metadata