spritesheet-gen
Pass
Audited by Gen Agent Trust Hub on Jul 12, 2026
Risk Level: SAFE
Full Analysis
- [PROMPT_INJECTION]: The skill possesses a surface for indirect prompt injection via the interpolation of user-provided specifications into generation prompts and processing scripts.
- Ingestion points: Data provided in the 'Sheet Spec' (subject, actions, output_path) within
SKILL.md. - Boundary markers: Absent; the skill does not utilize delimiters or specific instructions to sanitize or isolate these inputs.
- Capability inventory: The skill performs image generation via backend calls and file system operations using Pillow.
- Sanitization: No input validation or escaping is present.
- [COMMAND_EXECUTION]: The skill utilizes
python -cto execute a script for image slicing. This script dynamically incorporates user-defined parameters. While this is a functional requirement for the skill's operation, it follows a pattern of dynamic script generation that requires trusted input for security.
Audit Metadata