skills/robomotionio/skills/pixel-art/Gen Agent Trust Hub

pixel-art

Pass

Audited by Gen Agent Trust Hub on Jun 21, 2026

Risk Level: SAFE
Full Analysis
  • [COMMAND_EXECUTION]: The script scripts/pixel_art_video.py executes the ffmpeg binary to encode processed images into video and GIF formats. This is implemented using subprocess.run with a list of arguments and the default shell=False setting, which is a secure practice that prevents command injection vulnerabilities. The execution is limited to the necessary functions for the skill's primary purpose.
  • [EXTERNAL_DOWNLOADS]: The skill documents dependencies on the well-known Pillow Python package and the standard ffmpeg utility. No unverified third-party scripts or remote payloads are downloaded or executed at runtime.
  • [DATA_EXFILTRATION]: Analysis of the Python scripts confirms that data operations are restricted to local file reads of source images and local file writes of processed output. No network calls or attempts to access sensitive environment variables, credentials, or system configuration files were found.
  • [PROMPT_INJECTION]: The instructions in SKILL.md define a workflow for interacting with users to select art styles and animation scenes. There are no patterns that attempt to override safety guardrails, extract system prompts, or bypass agent constraints.
Audit Metadata
Risk Level
SAFE
Analyzed
Jun 21, 2026, 08:19 AM
Security Audit — agent-trust-hub — pixel-art