spritecook-workflow-essentials — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited spritecook-workflow-essentials (Agent Skill) and scored it 92/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 2 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 2 flagged
The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.
A bulleted imperative like {match} tells the agent to never reveal, disclose, or mention something to the user. Used adversarially it can instruct the agent to hide its tool calls or lie about what it did — stripping the transparency a user relies on to trust the agent.
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Use this alongside the SpriteCook image or animation skill whenever SpriteCook MCP tools are available.
Requires: SpriteCook MCP server connected to your editor. Set up with npx spritecook-mcp setup or see spritecook.ai.
get_credit_balance before starting a batch or multi-asset workflow.asset_id values in a local manifest whenever there is a writable workspace, unless the user explicitly wants a throwaway result.asset_id instead of generating from scratch again.list_recent_assets(limit=...) before failing.Authorization headers in agent output.spritecook-upload-assets plus create_asset_upload and finalize_asset_upload when a local file path needs to become a SpriteCook asset before animation, editing, reference, or tileset-style reuse.import_asset(image=..., pixel=..., display_name=..., file_name=...) only when the image is already a small data URL or raw base64 value that can be passed without printing it.remove_background(asset_id=...) for owned SpriteCook assets that need a transparent cutout. Use remove_background(image=...) only when the user supplies local image data and does not need a reusable imported asset first.update_asset_label(asset_id=..., label=...) after generation, import, or cleanup when a clearer asset name will help the project manifest or future agent steps.list_presets(query=...) first and identify the best matching preset by title, mode, and status.get_preset_settings(preset_id=...) and apply the returned settings as guidance for the next SpriteCook MCP generation or edit tool.settings.reference.styleAssetIds, contextAssetId, and editAssetId.settings.reference.styleAssetIds to style_asset_ids on generate_game_art; use up to 10 IDs.settings.reference.contextAssetId to reference_asset_id when the preset provides one specific visual/context reference asset.reference_asset_id when a prompt refers to one specific source or context asset, such as a particular building, character, prop, or part.edit_asset_id only for the one asset being directly modified.settings.reference.styleUploadUrls, contextUploadUrl, and editUploadUrl; use these only when the target MCP tool supports upload URL references.save_private_preset(...) only when the user explicitly asks to save a private preset. It creates a private draft preset only and does not publish, share, or submit anything for moderation.smart_crop_mode="tightest" for the best default results. Use "power_of_2" only when the user explicitly asks for it.gemini-2.5-flash-image: cheapestgemini-3.1-flash-image-preview: recommended defaultgemini-3-pro-image-preview: most expensiveasset_id as the primary stable identifier.sha12) for saved local files.asset_idsha12labelspritecook-assets.json unless the project already has an asset manifest.sha12 and match it against the manifest to recover the correct asset_id.list_recent_assets(limit=...).sprite_url as the single primary asset URL to inspect, save, or hand off to downstream tools.spritesheet_url as an optional secondary artifact. Use it only when present and only when you specifically need a spritesheet export.get_asset_metadata(asset_id) also exposes a primary url plus optional spritesheet_url._presigned_pixel_url or _presigned_url in agent-facing workflows unless no higher-level field is available.~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.