spritecook-upload-assets — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited spritecook-upload-assets (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Use this skill when a local image file should become a reusable SpriteCook asset_id.
Pair it with spritecook-workflow-essentials for credential safety, manifests, and downstream asset reuse.
file_name, MIME content_type, optional size_bytes, and whether pixel should be true.create_asset_upload(file_name=..., content_type=..., pixel=..., size_bytes=...).upload_url with HTTP PUT and the returned headers.finalize_asset_upload(upload_token=...).asset_id in the next SpriteCook tool.The upload URL and token are short-lived secrets. Do not print them in user-facing prose, save them to project files, or include them in manifests.
On Windows, upload without printing bytes:
Invoke-WebRequest -Method Put -Uri $uploadUrl -InFile $path -ContentType $contentType | Out-NullUse variables for $uploadUrl, $path, and $contentType; do not echo them if they include the upload token.
Use import_asset(image=...) only when the image is already a small data URL or base64 value that can be passed directly without logging it.
Do not use shell commands that print base64 to the terminal. If encoding is necessary, store the value in memory or a private variable and pass it directly to the MCP tool.
reference_asset_id when the uploaded asset is one specific source or context image.edit_asset_id only when the uploaded asset is the one image being directly modified.style_asset_ids on generate_game_art when uploaded assets are ambient style guides; pass up to 10 IDs.style_asset_id on generate_tileset for one tileset style guide image.asset_id on animate_game_art when the uploaded asset is the source to animate.Save the returned asset_id and a local file hash in the project manifest when the workspace is writable.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.