pixel-sprite
Pass
Audited by Gen Agent Trust Hub on Sep 29, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted user data (images and text) to generate descriptive prompts for image models.
- Ingestion points: Reference images and text descriptions provided by the user as defined in
SKILL.md. - Boundary markers: The skill employs a structured 'Subject Feature Card' to organize features, though it lacks explicit safety boundaries to prevent the model from following instructions embedded in the data.
- Capability inventory: The skill invokes image generation and editing tools within the host environment.
- Sanitization: User input is converted into descriptive attributes; no explicit filtering or sanitization of input text is documented.
- [EXTERNAL_DOWNLOADS]: The documentation provides instructions for installing the skill from a remote repository.
- Evidence:
README.mdreferences installation vianpx skills add yzfly/skills@pixel-spriteandgit clone https://github.com/yzfly/skills.git. - Context: These resources belong to the vendor's own infrastructure and are part of the standard deployment process.
Audit Metadata