agent-sprite-forge-2d-game-assets
Warn
Audited by Gen Agent Trust Hub on Oct 8, 2026
Risk Level: MEDIUMEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill instructs users to download the core implementation from a third-party GitHub repository.
- Evidence:
git clone https://github.com/0x0funky/agent-sprite-forge.gitin the installation section. - [REMOTE_CODE_EXECUTION]: The installation process involves cloning a remote repository and installing dependencies, which are then executed as part of the skill's core functionality.
- Evidence: The skill uses
pip install -r requirements.txtand then executes the code viapython -m agent_sprite_forgeor by importing modules likeagent_sprite_forge.SpriteGenerator. - [INDIRECT_PROMPT_INJECTION]: The skill processes user-supplied text prompts and reference images without explicit boundary markers or sanitization, which are then passed to external image generation models.
- Ingestion points: The
promptparameter in functions such asgenerate(),generate_layered_map(), andgenerate_godot_map()(SKILL.md). - Boundary markers: None identified in the provided code snippets or instructions.
- Capability inventory: The skill has file system write capabilities (
output_dir), image processing logic, and CLI execution paths. - Sanitization: No sanitization or input validation logic is shown for the prompt strings before they are sent to the AI backend.
Audit Metadata