pixel-art
Pass
Audited by Gen Agent Trust Hub on Sep 1, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill ingests external image files and user-defined inputs through the clarify tool and script arguments. This ingestion of untrusted data represents an attack surface for indirect prompt injection.\n
- Ingestion points: Source images (in.jpg) and user selections for presets and animation scenes.\n
- Boundary markers: Absent. The documentation does not specify the use of delimiters or 'ignore' instructions for processed data.\n
- Capability inventory: The skill performs file system writes and executes shell commands for video encoding via ffmpeg.\n
- Sanitization: The provided instructions do not detail input validation or escaping for the parameters passed to the processing scripts.\n- [EXTERNAL_DOWNLOADS]: The skill depends on Pillow, a standard and well-known image processing library from the official Python package registry.\n- [COMMAND_EXECUTION]: The skill relies on ffmpeg to generate animated videos. The use of external binary execution for media processing represents a capability that must be monitored for safe argument handling.
Audit Metadata