pixelfx
A plugin and skill for pixel art VFX. It ships a library of about 244 code-defined effects in 20 categories, exports sprite sheets for engines such as Godot, Unity and Phaser, and gives the agent a draft, render, look and refine loop for making new effects.
What it can touch
| files | write |
|---|---|
| network | fonts.googleapis.com, github.com, www.spritefusion.com |
| shell | runs commands |
| secrets | none found |
What it actually does
SKILL.md tells the agent to work in a pixelfx checkout, cloning https://github.com/patch-gg/pixelfx if none is present. It then runs local Node scripts (tools/render.mjs, list.mjs, new.mjs, act.mjs, check.mjs). These write PNG contact sheets, sprite sheets, JSON atlases and optional GIF/MP4 previews (via ffmpeg) under records/. The agent opens those images to judge its work and writes new effect files under src/fx/. The library code shown (src/core/*, the src/fx effects, gallery/app.js) is pure, deterministic rendering math. It has no filesystem, network, process or environment access. The browser gallery uses the clipboard API only for a "copy code" button. The Node tool scripts the agent is told to run (tools/*.mjs, including serve.mjs and the png library) were left out of the bundle, so their behavior could not be checked. No hidden characters, prompt injection or instructions aimed at the reviewer were found.
What the check found
mediumAgent clones and runs Node scripts that were not in the reviewed bundle
The skill tells the agent to git clone the pixelfx repo and then run node tools/*.mjs scripts. Those scripts (render.mjs, list.mjs, new.mjs, act.mjs, check.mjs, serve.mjs, lib/png.mjs) were omitted from the bundle, so their filesystem and network behavior is unverified. The cloned repo could also differ from what was reviewed. The library code that was visible is benign, and running local render scripts is consistent with the stated purpose.
skills/pixelfx/SKILL.md:22 project: `git clone https://github.com/patch-gg/pixelfx`. No install step: the tools use only Node.
skills/pixelfx/SKILL.md:23 2. Check it runs: `node tools/render.mjs fire/torch` writes `records/fire/torch/contact.png`. Open that PNG with
Keep an eye on it
This check is of one commit. Watch pixelfx and we'll email you if a later commit changes what it can touch.
Made this? Add the badge
[](https://plugsday.com/tools/patch-gg-pixelfx)About this check
Checked November 2, 2026 at commit a84159688af3, 313 files. Rules for known red flags, then two Claude reviews, one of them told to assume the author is malicious. A later commit hasn't been checked. How checks work.