ai-pixel-perfect-design-generator
Warn
Audited by Gen Agent Trust Hub on Sep 16, 2026
Risk Level: MEDIUMEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill recommends installing the
@aipixelperfect/clientpackage via NPM and theaipixelperfect-sdkpackage via Pip. These packages originate from sources that are not recognized as trusted organizations or part of the specific vendor's infrastructure. - [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted text prompts from users and interpolates them into API requests for image synthesis and refinement.
- Ingestion points: User-provided
promptinput in the JavaScript, Python, and HTML implementation examples within SKILL.md. - Boundary markers: Absent; user input is passed directly into the
synthesizeandrefineAPI calls without delimiters or explicit instructions to ignore embedded instructions. - Capability inventory: The skill performs network operations via
fetchand client SDKs toapi.aipixelperfect.comandabnormal-codex.github.io. - Sanitization: No evidence of input sanitization, validation, or escaping before transmission to the remote service.
Audit Metadata