produce-game-2d-sprites
Pass
Audited by Gen Agent Trust Hub on Sep 26, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The script
scripts/video2dsprite.pyutilizes theffmpegutility to extract frames from video files. - Evidence: The script uses
subprocess.runwith a list of arguments, which is a secure practice to prevent shell injection. The binary path is resolved usingshutil.whichand the input paths are converted to strings safely. - [INDIRECT_PROMPT_INJECTION]: The skill ingests user-provided text which is then used to construct prompts for image generation models.
- Ingestion Points: User input is received through the
--promptargument inscripts/generate2dsprite.pyand the--nameargument inscripts/video2dsprite.py. - Boundary Markers: No explicit boundary delimiters are used to wrap user input within the generated prompts, though the risk is localized to the image generation process rather than agent execution.
- Capability Inventory: The skill possesses file system access for image processing and the ability to execute the
ffmpegbinary. - Sanitization: Input strings used in file naming are sanitized using a regular expression in the
sanitize_slugfunction.
Audit Metadata