guided-cartoon-short
Warn
Audited by Gen Agent Trust Hub on Oct 23, 2026
Risk Level: MEDIUMEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill utilizes
npx -y @helios-project/cli@latestto download and execute a third-party package from the npm registry at runtime. - [REMOTE_CODE_EXECUTION]: Executing an external CLI tool via npx allows for the execution of remote code not contained within the skill's source files.
- [INDIRECT_PROMPT_INJECTION]: The skill's workflow ingests external data that influences generated code and agent actions.
- Ingestion points: User prompts and random seed strings are used to generate the character rig and
STORYBOARD.mdcontents. - Boundary markers: No explicit boundary markers or delimiters are used when the agent processes these external inputs.
- Capability inventory: The skill enables the agent to execute shell commands and generate/run executable JavaScript/HTML files.
- Sanitization: The skill does not describe any sanitization or validation of user-controlled inputs before they are used for code generation.
Audit Metadata