card-news-generator-v2
Pass
Audited by Gen Agent Trust Hub on Sep 16, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes user-supplied topics, titles, and descriptions to generate PNG image files. * Ingestion points: content is ingested through
sys.stdininauto_generator.py, interactive user input ininteractive_generator.py, and command-line arguments ingenerate_card.py. * Boundary markers: The skill does not implement delimiters or 'ignore' instructions to separate user data from processing logic. * Capability inventory: The skill utilizes thePillowlibrary to perform file system writes andos.makedirsto create directories. * Sanitization: Input text is formatted for layout usingtextwrapbut is not sanitized to remove potential prompt injection markers that could influence an agent if the output text were ever re-parsed. - [COMMAND_EXECUTION]: Documentation files like
README.mdandQUICKSTART_KR.mdprovide instructions for the user to executesudo apt-getcommands to install Korean font packages required for the skill to function properly. - [EXTERNAL_DOWNLOADS]: The skill identifies dependencies on the
PillowPython package andNotoCJK fonts, which are fetched from official package registries (PyPI and Ubuntu repositories).
Audit Metadata