thumbnail-generator
Pass
Audited by Gen Agent Trust Hub on Sep 27, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill accepts user-provided strings such as
topic,key_details, andtext_overlaywhich are interpolated into output templates. While this creates an attack surface for indirect prompt injection, the skill lacks any dangerous capabilities (like network access or file system writes), which mitigates the risk. - Ingestion points: Input parameters defined in the schema section of
SKILL.md(topic,key_details,text_overlay). - Boundary markers: Absent; inputs are directly placed into specific prompt placeholders.
- Capability inventory: None detected. The skill only generates text prompts for use in external image generators.
- Sanitization: None; the skill does not perform explicit escaping or validation on user inputs.
Audit Metadata