spritecook-upload-assets
Pass
Audited by Gen Agent Trust Hub on Aug 14, 2026
Risk Level: SAFEDATA_EXFILTRATIONCOMMAND_EXECUTION
Full Analysis
- [DATA_EXFILTRATION]: The skill facilitates the transfer of local user images to an external endpoint. This behavior is the primary intended function for the SpriteCook service, and the instructions prioritize security by advising against logging upload tokens or file contents.- [COMMAND_EXECUTION]: The skill provides a PowerShell command pattern using
Invoke-WebRequestfor Windows environments. It specifically recommends piping output toOut-Nullto prevent sensitive information leakage into the agent's history or console.- [INDIRECT_PROMPT_INJECTION]: The skill interacts with local file data and performs workspace writes.\n - Ingestion points: Accesses local images via file paths provided by the user.\n
- Boundary markers: Relies on operational warnings and log suppression instead of content delimiters for binary assets.\n
- Capability inventory: Combines file system access, network upload via PowerShell, and metadata writes to manifest files.\n
- Sanitization: Recommends suppressing command output and using memory-based variables for binary data to avoid exposure in logs.
Audit Metadata