spine-animation

Pass

Audited by Gen Agent Trust Hub on Aug 27, 2026

Risk Level: SAFE
Full Analysis
  • [SAFE]: The skill implements a professional animation workflow using local processing and official AI services.
  • [EXTERNAL_DOWNLOADS]: The skill downloads standard libraries and tools.
  • Installs opencv-python, Pillow, numpy, and google-generativeai from PyPI.
  • References the official Spine Web Player from UNPKG CDN in generated HTML previews.
  • [CREDENTIALS_UNSAFE]: Sensitive keys are handled securely.
  • Instructs users to set GEMINI_API_KEY and FAL_KEY as environment variables.
  • The companion Reskin Studio app stores keys in ~/.genie-reskin/secrets.json with file permissions set to 0600.
  • [COMMAND_EXECUTION]: The skill executes Python scripts to perform character rigging and JSON generation.
  • Scripts like split_character.py and position_parts.py are run via the command line as part of the intended animation pipeline.
  • [DATA_EXFILTRATION]: Network activity is legitimate and user-controlled.
  • Outbound requests are limited to Google Gemini, fal.ai, and user-provided SAM server endpoints.
  • [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted user assets but maintains safety.
  • It ingests PNG images and Spine JSON files but handles them through standard libraries (OpenCV, PIL) rather than using them to influence executable logic.
Audit Metadata
Risk Level
SAFE
Analyzed
Aug 27, 2026, 08:08 AM
Security Audit — agent-trust-hub — spine-animation