skills/htdt/godogen/asset-gen/Gen Agent Trust Hub

asset-gen

Pass

Audited by Gen Agent Trust Hub on Oct 16, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The script tools/rembg_matting.py executes the nvidia-smi command via subprocess.run to check for the presence of an NVIDIA GPU. This is used solely to determine whether hardware acceleration is available for background removal tasks.
  • [EXTERNAL_DOWNLOADS]: The skill facilitates the download of several external components and data. It provides instructions to install the tripo-cli from NPM (a well-known 3D generation service) and to clone the kimodo-practical repository from the author's GitHub for animation workflows. Additionally, tools/asset_gen.py uses the requests library to download video files from URLs generated by the xAI SDK during sprite creation.
  • [INDIRECT_PROMPT_INJECTION]: The skill processes user-defined text prompts to drive external image and video generation APIs, creating a potential surface for indirect prompt injection.
  • Ingestion points: User-provided strings passed to the --prompt argument in tools/asset_gen.py.
  • Boundary markers: None identified; the prompts are interpolated directly into API calls.
  • Capability inventory: The skill performs file system writes for generated assets and network operations to interact with Google and xAI services.
  • Sanitization: No specific sanitization or escaping of the prompt input is implemented within the scripts.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 16, 2026, 10:48 PM