spritecook-generate-tilesets
Pass
Audited by Gen Agent Trust Hub on Oct 13, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes user-supplied text prompts and asset identifiers for image generation. While these are ingestion points for external data, they are used within the defined scope of the SpriteCook workflow and do not pose a direct threat to the agent's execution environment.\n
- Ingestion points:
promptparameter and referenced asset IDs in thegenerate_tilesettool.\n - Boundary markers: No specific delimiters or safety warnings are described for the prompt field.\n
- Capability inventory: The skill workflow involves asset uploading, importing, and tileset generation via the SpriteCook MCP server tools.\n
- Sanitization: Sanitization is handled by the remote SpriteCook service rather than the skill instructions.\n- [REMOTE_CODE_EXECUTION]: The skill documentation includes a setup command
npx spritecook-mcp setup. This is a standard procedure for configuring the vendor's official MCP server and does not indicate malicious activity.
Audit Metadata