bfs-audio-album-creator
Pass
Audited by Gen Agent Trust Hub on Jul 14, 2026
Risk Level: SAFE
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted multimodal source material (text, audio, images, video) which is subsequently processed by subagents to generate content. This creates a surface for indirect prompt injection attacks.
- [INGESTION_POINTS]: User-supplied files and folders are distilled into a material archive in Step 1.
- [BOUNDARY_MARKERS]: A 'Creative Contract Card' is used to define constraints and consistency for subagents in Step 3, and a three-pass polish protocol is mandated in Step 4.
- [CAPABILITY_INVENTORY]: The skill performs file system writes for markdown plans and utilizes a Python script (scripts/gen_cover.py) for network-based image generation.
- [SANITIZATION]: Step 1 includes explicit instructions to flag and handle sensitive or dark content. Step 7 involves a 'fresh-eyes' QA subagent performing an adversarial re-check of the final output.
- [EXTERNAL_DOWNLOADS]: The scripts/gen_cover.py script facilitates the download of image assets from external APIs (GRS AI, Google, and OpenAI). These operations are part of the core functionality for generating album covers.
- [COMMAND_EXECUTION]: Instructions in Step 10 guide the agent to use the date command to generate precise timestamps for output file headers, which is a benign use of system tools.
Audit Metadata