skills/openai/plugins/sprite-pipeline/Gen Agent Trust Hub

sprite-pipeline

Pass

Audited by Gen Agent Trust Hub on Sep 21, 2026

Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
  • [Data Processing Surface]: The skill ingests and processes image assets, such as seed frames, to create animation sequences. Processing external files is a point where the agent interacts with data that could potentially contain indirect instructions.
  • Ingestion Points: The "Core Workflow" in SKILL.md initiates processing using an "approved in-game seed frame."
  • Boundary Markers: The instructions do not currently include specific markers or guidelines to disregard instructions that might be embedded in asset metadata.
  • Capability Inventory: The skill performs file writing and image manipulation via local script execution (build_sprite_edit_canvas.py, normalize_sprite_strip.py, render_sprite_preview_sheet.py).
  • Sanitization: There are no explicit instructions for validating or sanitizing the input assets before processing.
  • [Local Pipeline Execution]: The skill defines a series of shell commands for local Python scripts to automate the asset generation process. These commands manage the flow of data between generation and normalization steps.
  • Evidence: SKILL.md includes recipes for running scripts like normalize_sprite_strip.py and render_sprite_preview_sheet.py to handle project assets.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 21, 2026, 09:43 AM
Security Audit — agent-trust-hub — sprite-pipeline