hiapi-game-assets

Pass

Audited by Gen Agent Trust Hub on Oct 7, 2026

Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
  • [INDIRECT_PROMPT_INJECTION]: The skill ingests user-supplied game descriptions and art style requirements, which are then directly interpolated into prompts sent to the HiAPI AI models.
  • Ingestion points: The game and style fields in plan.json are populated from user input in the initial workflow step.
  • Boundary markers: The skill does not use specific delimiters or protective instructions to wrap the user-supplied content when constructing the final prompt in scripts/run-plan.mjs.
  • Capability inventory: The skill can perform network operations (fetching assets), write to the file system (saving assets), and execute subprocesses (Python slicing and video recording).
  • Sanitization: No sanitization or filtering is applied to user input before prompt construction.
  • [EXTERNAL_DOWNLOADS]: The skill fetches content from external sources during installation and operation.
  • The scripts/install.mjs script clones the repository from github.com/HiAPIAI/hiapi-game-asset-studio-skill.git to install the skill.
  • The scripts/run-plan.mjs script downloads generated images, audio, and video files from api.hiapi.ai using the fetch API.
  • [COMMAND_EXECUTION]: The skill relies on executing external binaries and scripts to process assets and prototypes.
  • The workflow utilizes uv run to execute a Python script (scripts/slice.py) with pillow, numpy, and scipy for image manipulation.
  • The scripts/record.mjs utility executes ffmpeg and attempts to launch a local Google Chrome instance for gameplay recording.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 7, 2026, 01:03 AM