The Agent Skills Directory

[COMMAND_EXECUTION]: The skill executes several command-line tools via the subprocess module to perform its core functions. These include codex for AI image generation, npm for updating game manifests, and ffmpeg for video processing. All calls use the list format of subprocess.run, which is a safe practice that prevents shell injection.
[EXTERNAL_DOWNLOADS]: The skill identifies and guides the user to install well-known external dependencies for optional functionality, such as rembg for background removal and the Codex CLI for the primary generation backend. These are legitimate tools within the game development ecosystem and are not downloaded or executed silently.
[PROMPT_INJECTION]: The pipeline uses a robust slot-based prompt scaffolding system (sprite_prompt.py). User-provided descriptions are interpolated into structured templates that include hardcoded rules for background color, framing, and negative constraints. This design ensures that user input cannot easily override the pipeline's operational requirements.
[CREDENTIALS_UNSAFE]: The skill handles sensitive API keys (GEMINI_API_KEY, GOOGLE_API_KEY) by accessing them through environment variables. It does not hardcode secrets, and its documentation explicitly warns against using unauthorized third-party services, adhering to a strict user-owned-key policy.

game-sprite-pipeline