spritecook-generate-tilesets

Pass

Audited by Gen Agent Trust Hub on Aug 21, 2026

Risk Level: SAFE
Full Analysis
  • [PROMPT_INJECTION]: The skill processes user-supplied natural language prompts to generate tilesets, which is a standard functional surface for indirect prompt injection.
  • Ingestion points: User-provided prompt parameter in the generate_tileset tool defined in SKILL.md.
  • Boundary markers: No explicit delimiters or "ignore embedded instructions" directives are provided for handling the prompt input.
  • Capability inventory: The skill utilizes tools for asset generation, job status polling, and automated recovery steps.
  • Sanitization: No explicit sanitization or validation of the input prompt is described in the skill instructions.
  • [EXTERNAL_DOWNLOADS]: The skill references the SpriteCook MCP server package for environment setup.
  • Evidence: Mentions setup via npx spritecook-mcp setup in the requirements section of SKILL.md. This is a vendor-provided tool for accessing the service.
  • [DYNAMIC_EXECUTION]: The skill instructs the agent to execute tool calls provided dynamically within API responses for error recovery.
  • Evidence: Mentions executing the warning.recovery tool call if an asset is unavailable. This is a functional mechanism provided by the vendor's asset generation lifecycle.
Audit Metadata
Risk Level
SAFE
Analyzed
Aug 21, 2026, 12:00 PM
Security Audit — agent-trust-hub — spritecook-generate-tilesets