Sprite Animator

• Outcome: Review
• Latest audit: Sep 10, 2026 · 4:25 PM UTC
• Version: 0.1.0

Overview

The skill appears purpose-aligned, but it runs an unpinned external package that can change after review while using a Gemini API key and user images.

Review the `sprite-animator` package and consider pinning a known version or running it in an isolated environment. Do not use sensitive personal, confidential, or proprietary images unless you accept that they will be processed through Gemini and by the downloaded package.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:18

Finding

Unpinned Third-Party Package Retrieval and Execution

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 18–27
Vulnerability Type: Unpinned and unaudited runtime dependency execution
Risk Level: Medium

Vulnerable Code:

bash

## Quick Start

# Wave animation (default 16 frames)
uv run --with sprite-animator sprite-animator -i photo.png -o sprite.gif -a wave

# Bounce animation with larger sprites
uv run --with sprite-animator sprite-animator -i avatar.png -o bounce.gif -a bounce -s 256

# Keep the raw sprite sheet and individual frames
uv run --with sprite-animator sprite-animator -i pet.jpg -o dance.gif -a dance --keep-sheet --keep-frames

Technical Analysis

The documented commands instruct users to resolve and execute the third-party sprite-animator package through uv without specifying an exact version or cryptographic hashes. The audited project contains no implementation source, dependency lockfile, integrity metadata, or vendored package against which the executed behavior can be verified.

Consequently, the code executed by these commands may change after the Skill has been reviewed. A compromised package publisher account, malicious future release, or package-registry supply-chain incident could introduce arbitrary installation-time or runtime behavior. The package process may inherit the user's environment, including the required GEMINI_API_KEY, and receive access to the input images and output paths supplied on the command line.

This finding establishes an insecure dependency boundary; it does not establish that the current external package is malicious.

Attack Path

1. An attacker compromises the package publisher, package registry, or a future release of the unpinned sprite-animator dependency.
2. The attacker publishes a modified package containing malicious installation or entry-point code.
3. A user follows one of the documented uv run --with sprite-animator commands.
4. uv resolves and retrieves the packa ...[truncated 970 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin sprite-animator to an exact, reviewed version rather than allowing unconstrained resolution.
2. Maintain a committed lockfile containing exact transitive dependency versions and cryptographic hashes.
3. Configure uv to retrieve packages only from an explicitly trusted registry and require integrity verification where supported.
4. Review the package source, build configuration, installation hooks, entry point, and transitive dependencies before approving upgrades.
5. Prefer bundling auditable implementation source with the Skill when practical so reviewed behavior cannot change independently.
6. Run the dependency with least privilege in an isolated environment. Expose only the necessary input and output paths and restrict unnecessary network and filesystem access.
7. Provide GEMINI_API_KEY only to the process that requires it, use a narrowly scoped credential where supported, and rotate the credential if dependency compromise is suspected.
8. Adopt an explicit dependency-update process in which version and hash changes require security review before deployment.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The skill explicitly states that it sends the user's source image to Gemini in a single request, but the description and usage guidance do not clearly warn users that their uploaded images are transmitted to an external AI service. This creates a privacy and data-handling risk because users may provide sensitive personal photos or proprietary images without informed consent.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.