game-art-reference-packs
Pass
Audited by Gen Agent Trust Hub on Sep 16, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill instructs the agent to execute specific Python scripts located within the repository's
tools/directory (e.g.,prepare_meshy_reference_packs.pyandprepare_roster_reference_packs.py). These commands are used to process local art assets and generate manifests, which is consistent with the skill's stated purpose of game art preparation. - [INDIRECT_PROMPT_INJECTION]: The skill possesses an indirect prompt injection surface as it processes external data from JSON configuration files to drive tool execution. While this is a standard operational pattern for this type of tool, it represents a surface where malicious data in the source files could influence agent behavior.
- Ingestion points: The agent reads project metadata and configuration from
ArtSource/3D/Roster/subjects.json,ArtSource/3D/Meshy/manifest.json, andArtSource/3D/References/Turnarounds/roster-generation.json. - Boundary markers: No explicit delimiters or instructions to ignore embedded commands within these data files are mentioned.
- Capability inventory: The skill uses subprocess calls to execute Python tools (
python3 tools/...) that generate PNG images and JSON templates based on the ingested data. - Sanitization: No specific sanitization or validation logic for the input JSON files is described in the provided instructions.
Audit Metadata