produce-game-2d-sprites

Pass

Audited by Gen Agent Trust Hub on Sep 26, 2026

Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The script scripts/video2dsprite.py utilizes the ffmpeg utility to extract frames from video files.
  • Evidence: The script uses subprocess.run with a list of arguments, which is a secure practice to prevent shell injection. The binary path is resolved using shutil.which and the input paths are converted to strings safely.
  • [INDIRECT_PROMPT_INJECTION]: The skill ingests user-provided text which is then used to construct prompts for image generation models.
  • Ingestion Points: User input is received through the --prompt argument in scripts/generate2dsprite.py and the --name argument in scripts/video2dsprite.py.
  • Boundary Markers: No explicit boundary delimiters are used to wrap user input within the generated prompts, though the risk is localized to the image generation process rather than agent execution.
  • Capability Inventory: The skill possesses file system access for image processing and the ability to execute the ffmpeg binary.
  • Sanitization: Input strings used in file naming are sanitized using a regular expression in the sanitize_slug function.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 26, 2026, 12:33 PM