phaser4-spine-generative-reskin
Pass
Audited by Gen Agent Trust Hub on Oct 15, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: No malicious patterns or security vulnerabilities were detected. The skill's operations are confined to local file system management for asset processing, utilizing atomic writes and path resolution checks to ensure data integrity and execution safety.
- [COMMAND_EXECUTION]: The skill implements a local command-line interface using Node.js to manage a pipeline for Spine asset auditing and generation. This functionality is entirely local and consistent with the skill's documented purpose.
- [EXTERNAL_DOWNLOADS]: The skill relies on the 'sharp' library for image processing. This dependency is a well-known, reputable package managed through the official npm registry.
- [INDIRECT_PROMPT_INJECTION]: The skill processes external data (Spine JSON and Atlas files) but implements robust path validation logic (using realpath resolution and bounds checking) to prevent directory traversal and ensure that operations remain within authorized candidate directories.
Audit Metadata