hiapi-game-assets
Pass
Audited by Gen Agent Trust Hub on Oct 7, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill ingests user-supplied game descriptions and art style requirements, which are then directly interpolated into prompts sent to the HiAPI AI models.
- Ingestion points: The
gameandstylefields inplan.jsonare populated from user input in the initial workflow step. - Boundary markers: The skill does not use specific delimiters or protective instructions to wrap the user-supplied content when constructing the final prompt in
scripts/run-plan.mjs. - Capability inventory: The skill can perform network operations (fetching assets), write to the file system (saving assets), and execute subprocesses (Python slicing and video recording).
- Sanitization: No sanitization or filtering is applied to user input before prompt construction.
- [EXTERNAL_DOWNLOADS]: The skill fetches content from external sources during installation and operation.
- The
scripts/install.mjsscript clones the repository fromgithub.com/HiAPIAI/hiapi-game-asset-studio-skill.gitto install the skill. - The
scripts/run-plan.mjsscript downloads generated images, audio, and video files fromapi.hiapi.aiusing thefetchAPI. - [COMMAND_EXECUTION]: The skill relies on executing external binaries and scripts to process assets and prototypes.
- The workflow utilizes
uv runto execute a Python script (scripts/slice.py) withpillow,numpy, andscipyfor image manipulation. - The
scripts/record.mjsutility executesffmpegand attempts to launch a local Google Chrome instance for gameplay recording.
Audit Metadata