skills/a-dev/quizbun/create-quiz/Gen Agent Trust Hub

create-quiz

Pass

Audited by Gen Agent Trust Hub on Aug 26, 2026

Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [COMMAND_EXECUTION]: The skill uses node to execute a local validation script (scripts/validate-quiz.mjs). This is used to ensure the generated quiz JSON adheres to the 'Quiz Object Standard v1' and performs checks that cannot be handled by the JSON schema alone.
  • [INDIRECT_PROMPT_INJECTION]: The skill processes user-provided topics and the resulting quiz data as part of its authoring and repair workflows. This creates a surface where untrusted data is processed by the agent.
  • Ingestion points: User-supplied topics and question parameters in SKILL.md; quiz JSON content during validation and repair steps.
  • Boundary markers: The prompt template in references/quiz-generation-prompt.md uses placeholder labels but lacks specific instructions to ignore malicious directives within the user-provided topic.
  • Capability inventory: Execution of local Node.js scripts and network access for media verification.
  • Sanitization: The skill description states that the validation script performs markdown and sanitization checks.
  • [EXTERNAL_DOWNLOADS]: The skill references the official JSON Schema website (json-schema.org) for its draft schema definition, which is a well-known and trusted service.
Audit Metadata
Risk Level
SAFE
Analyzed
Aug 26, 2026, 08:38 PM