spine-animation
Pass
Audited by Gen Agent Trust Hub on Aug 27, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill implements a professional animation workflow using local processing and official AI services.
- [EXTERNAL_DOWNLOADS]: The skill downloads standard libraries and tools.
- Installs
opencv-python,Pillow,numpy, andgoogle-generativeaifrom PyPI. - References the official Spine Web Player from UNPKG CDN in generated HTML previews.
- [CREDENTIALS_UNSAFE]: Sensitive keys are handled securely.
- Instructs users to set
GEMINI_API_KEYandFAL_KEYas environment variables. - The companion Reskin Studio app stores keys in
~/.genie-reskin/secrets.jsonwith file permissions set to0600. - [COMMAND_EXECUTION]: The skill executes Python scripts to perform character rigging and JSON generation.
- Scripts like
split_character.pyandposition_parts.pyare run via the command line as part of the intended animation pipeline. - [DATA_EXFILTRATION]: Network activity is legitimate and user-controlled.
- Outbound requests are limited to Google Gemini, fal.ai, and user-provided SAM server endpoints.
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted user assets but maintains safety.
- It ingests PNG images and Spine JSON files but handles them through standard libraries (OpenCV, PIL) rather than using them to influence executable logic.
Audit Metadata