asset-gen
Pass
Audited by Gen Agent Trust Hub on Oct 16, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The script
tools/rembg_matting.pyexecutes thenvidia-smicommand viasubprocess.runto check for the presence of an NVIDIA GPU. This is used solely to determine whether hardware acceleration is available for background removal tasks. - [EXTERNAL_DOWNLOADS]: The skill facilitates the download of several external components and data. It provides instructions to install the
tripo-clifrom NPM (a well-known 3D generation service) and to clone thekimodo-practicalrepository from the author's GitHub for animation workflows. Additionally,tools/asset_gen.pyuses therequestslibrary to download video files from URLs generated by the xAI SDK during sprite creation. - [INDIRECT_PROMPT_INJECTION]: The skill processes user-defined text prompts to drive external image and video generation APIs, creating a potential surface for indirect prompt injection.
- Ingestion points: User-provided strings passed to the
--promptargument intools/asset_gen.py. - Boundary markers: None identified; the prompts are interpolated directly into API calls.
- Capability inventory: The skill performs file system writes for generated assets and network operations to interact with Google and xAI services.
- Sanitization: No specific sanitization or escaping of the prompt input is implemented within the scripts.
Audit Metadata