pixel-art
Pass
Audited by Gen Agent Trust Hub on Oct 7, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted image data from users which could potentially influence agent behavior if the agent processes the contents of these files as instructions. Ingestion points:
input_pathinscripts/pixel_art.pyandbase_imageinscripts/pixel_art_video.py. Boundary markers: No specific delimiters or warnings for the agent are implemented when handling these external files. Capability inventory: The skill can write files via Pillow and execute external commands viaffmpeg. Sanitization: The skill does not perform explicit sanitization or metadata filtering on the input images. - [COMMAND_EXECUTION]: The skill executes external shell commands to facilitate video encoding. Evidence:
scripts/pixel_art_video.pycallssubprocess.run()to invokeffmpegfor MP4 and GIF creation. Context: The execution is handled via a list of arguments withoutshell=True, which is a safer implementation. This functionality is essential for the skill's primary purpose of creating animated pixel art.
Audit Metadata