architecture-generator
Pass
Audited by Gen Agent Trust Hub on Aug 28, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted user data which could contain malicious instructions designed to influence the AI agent's behavior during the 3D generation workflow.
- Ingestion points: The
promptandimagesparameters intoy_generator_design_draftandtoy_generator_task_createAPIs accept user-supplied content (SKILL.md). - Boundary markers: The skill documentation does not specify the use of delimiters or instructions to ignore embedded commands within the prompt or image metadata.
- Capability inventory: The skill performs network operations via
curlandnpxto external endpoints atagent.deepnlp.org(SKILL.md). - Sanitization: There is no evidence of sanitization or validation of the input strings before they are incorporated into API requests.
- [EXTERNAL_DOWNLOADS]: The skill interacts with external services and fetches assets from remote domains.
- The skill sends data to and receives results from
https://agent.deepnlp.org/agent_router. - The skill references and displays images from
static.aiagenta2z.comandus-static.aiagenta2z.com, which are used to store and preview generated 3D assets.
Audit Metadata