book-cover-design
Pass
Audited by Gen Agent Trust Hub on Sep 14, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill references external installation instructions for the belt CLI tool from a GitHub repository (inference-sh/skills) and suggests adding external skills through the npx skills add command.
- [INDIRECT_PROMPT_INJECTION]: The skill instructions involve constructing shell commands by interpolating user-supplied prompt text. This creates a potential surface for command injection if the user input contains special characters like single quotes that could terminate the JSON string and execute additional shell commands.
- Ingestion points: User-provided cover descriptions and stylistic metadata (SKILL.md).
- Boundary markers: There are no explicit delimiters or instructions for the agent to ignore or escape control characters in user input.
- Capability inventory: The skill leverages the Bash(belt *) tool to communicate with remote AI inference services (SKILL.md).
- Sanitization: The skill documentation does not provide methods for input validation or shell-escaping of the dynamic prompt content.
Audit Metadata