agent-sprite-forge-2d-game-assets

Warn

Audited by Gen Agent Trust Hub on Oct 8, 2026

Risk Level: MEDIUMEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill instructs users to download the core implementation from a third-party GitHub repository.
  • Evidence: git clone https://github.com/0x0funky/agent-sprite-forge.git in the installation section.
  • [REMOTE_CODE_EXECUTION]: The installation process involves cloning a remote repository and installing dependencies, which are then executed as part of the skill's core functionality.
  • Evidence: The skill uses pip install -r requirements.txt and then executes the code via python -m agent_sprite_forge or by importing modules like agent_sprite_forge.SpriteGenerator.
  • [INDIRECT_PROMPT_INJECTION]: The skill processes user-supplied text prompts and reference images without explicit boundary markers or sanitization, which are then passed to external image generation models.
  • Ingestion points: The prompt parameter in functions such as generate(), generate_layered_map(), and generate_godot_map() (SKILL.md).
  • Boundary markers: None identified in the provided code snippets or instructions.
  • Capability inventory: The skill has file system write capabilities (output_dir), image processing logic, and CLI execution paths.
  • Sanitization: No sanitization or input validation logic is shown for the prompt strings before they are sent to the AI backend.
Audit Metadata
Risk Level
MEDIUM
Analyzed
Oct 8, 2026, 11:38 PM