defold-proto-file-editing
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes external image files provided by the user to generate geometric data (convex hulls and silhouette chains) and image metadata (dimensions). Processing untrusted data at runtime constitutes an indirect prompt injection attack surface, where a maliciously crafted input file could attempt to manipulate the generated output. The risk is considered low as the output is constrained to numeric data and Protobuf Text Format keywords.
- [EXTERNAL_DOWNLOADS]: The skill's image processing scripts (
image_loader.py) contain an optional dependency on the 'Pillow' (PIL) library, which is a widely used and well-known package for image manipulation in Python.
Audit Metadata