baoyu-comic
Pass
Audited by Gen Agent Trust Hub on Aug 14, 2026
Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill uses
npx -y bunto run internal utility scripts (e.g.,scripts/merge-to-pdf.ts) and to call a sibling skill (baoyu-image-gen) for image generation. These operations are restricted to the local environment and well-known runners. - [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted text content to generate narrative storyboards and image prompts, which creates a vulnerability to instructions embedded in the source material.
- Ingestion points: Source files (
source.md) and user-pasted articles analyzed in Step 1.2. - Boundary markers: None explicitly implemented to separate untrusted source data from agent instructions.
- Capability inventory: Subprocess execution for image generation and PDF assembly, as well as file system write operations for analysis, storyboard, and prompt files.
- Sanitization: The skill lacks explicit sanitization or validation logic for the ingested content.
Audit Metadata