pixellab-mcp

Pass

Audited by Gen Agent Trust Hub on Oct 15, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
  • [SAFE]: The skill defines a standard set of tools to interact with the PixelLab MCP Server for asset generation. The behavior matches the stated purpose of assisting with game development, and the server communication targets the vendor's documented API endpoint (api.pixellab.ai).
  • [EXTERNAL_DOWNLOADS]: The skill facilitates the retrieval of generated game assets from api.pixellab.ai. These downloads are core to the skill's functionality and occur after asynchronous background processing by the service.
  • [INDIRECT_PROMPT_INJECTION]: The skill processes user-defined descriptions to generate art assets, creating a potential surface for indirect injection.
  • Ingestion points: The description parameter in character and tileset creation tools (SKILL.md).
  • Boundary markers: No specific delimiters or safety warnings for the LLM regarding user-provided descriptions are present in the tool definitions.
  • Capability inventory: The skill makes external network calls to the PixelLab API and provides users with download links for assets.
  • Sanitization: The skill instructions do not specify any sanitization, filtering, or validation of the input strings before they are transmitted to the generation service.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 15, 2026, 04:19 AM