layer-tilesets
Pass
Audited by Gen Agent Trust Hub on Oct 29, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONREMOTE_CODE_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill references the
layerai/skillsrepository for resolving missing dependencies. This is an official resource owned by the skill's author and is used for intended platform functionality. - [COMMAND_EXECUTION]: Instructions guide the agent to suggest the command
npx skills add layerai/skills --skill <name>to the user. This is a manual installation process for expanding the agent's capabilities using vendor-verified tools. - [REMOTE_CODE_EXECUTION]: The use of
npxfor installing skill-based dependencies constitutes a remote execution pattern; however, it is restricted to official vendor infrastructure and requires user initiation. - [INDIRECT_PROMPT_INJECTION]: The skill processes user-provided descriptions to form prompts for generative AI tools.
- Ingestion points: User-supplied inputs for tile subject, material, and era in
SKILL.md. - Boundary markers: None explicitly specified in the instruction set.
- Capability inventory: Invocation of
execute_forgefor image generation andexport_tilesetfor file packaging. - Sanitization: No specific sanitization or escaping logic is described for the prompt interpolation.
Audit Metadata