animated-spritesheets
Pass
Audited by Gen Agent Trust Hub on Oct 10, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [SAFE]: All scripts are written in standard Node.js and rely exclusively on built-in modules (node:fs, node:path, node:zlib). The skill avoids external dependencies by including its own library for PNG and GIF manipulation, reducing supply chain risks.
- [INDIRECT_PROMPT_INJECTION]: The skill processes image data and prompts that may be influenced by external inputs, creating a theoretical attack surface for indirect injection.
- Ingestion points: Scripts in the scripts/ directory (e.g., process-sheet.mjs, chroma-clean.mjs) read PNG and GIF files provided as local paths or processed via external generation tools.
- Boundary markers: The prompt generation logic in sprite-prompt.mjs uses structured templates with specific sections to separate character identity references from action instructions.
- Capability inventory: The skill is limited to local file system operations, including reading, writing, and deleting files within the user-specified output directories.
- Sanitization: Input images are decoded into raw pixel buffers using a custom implementation, though no specific sanitization of image metadata is performed.
Audit Metadata