pixel-art
Pass
Audited by Gen Agent Trust Hub on Jul 11, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill executes a local Python script,
scripts/quantize.py, to process generated images. This script performs grid-alignment and palette quantization using the Pillow library. - [EXTERNAL_DOWNLOADS]: The skill requires the
Pillowimage processing library, which is installed from the official Python Package Index (PyPI) as specified inscripts/requirements.txt. - [PROMPT_INJECTION]: The skill possesses an indirect prompt injection surface as it ingests user-provided text briefs and reference images to generate prompts.
- Ingestion points: User-supplied image briefs and reference screenshots (documented in SKILL.md).
- Boundary markers: Employs a universal block structure (e.g.,
[STYLE],[PALETTE],[SUBJECT]) within templates to separate instruction components (documented in templates/scene-prompt.md and others). - Capability inventory: Execution of the
scripts/quantize.pyscript for file processing and invocation of image generation tools via host-native capabilities or MCP tools. - Sanitization: No explicit sanitization of user-provided text is described before interpolation into the prompt blocks.
- [SAFE_PRACTICE]: Implements a mandatory Phase 0 gate that explicitly declines requests requiring exact text, layout, or brand tokens, ensuring the agent does not attempt out-of-scope composition tasks.
- [SAFE_PRACTICE]: Includes a non-negotiable IP guardrail that forbids referencing specific artists in prompts and instructs the agent to rewrite any user requests that name artists into descriptive craft markers.
Audit Metadata