game-tilesets
Pass
Audited by Gen Agent Trust Hub on Aug 7, 2026
Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill instructs the agent to generate and execute image processing code to verify assets.
- Evidence: In Section 1, the instructions state: "MANDATORY check: composite a real 2×2 repeat with PIL to a throwaway file and view it."
- [PROMPT_INJECTION]: The skill possesses an indirect prompt injection surface by processing untrusted user data to drive agent actions and file operations.
- Ingestion points: User requests defining the type and style of game assets ("Users state WHAT they need").
- Boundary markers: Absent. The skill does not define specific delimiters or instructions to ignore embedded commands within user-provided asset descriptions.
- Capability inventory: The agent is instructed to use PIL (Python Imaging Library) for image manipulation and to perform file-write operations to create "throwaway" verification images.
- Sanitization: Absent. There are no instructions for validating or sanitizing user-provided strings before they are used in prompts or verification scripts.
Audit Metadata