poster
Pass
Audited by Gen Agent Trust Hub on Jun 16, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill utilizes shell commands through authorized tools to manage output, specifically using
mkdirto create structured directories for assets anddateto generate unique timestamps for file naming. - [EXTERNAL_DOWNLOADS]: The skill uses
curlto download generated poster images from remote URLs provided by the image generation tool to the local file system. - [EXTERNAL_DOWNLOADS]: The documentation provides instructions for users to install the
@blockrun/mcppackage vianpx. This is identified as a vendor-provided resource necessary for the skill's operation. - [PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because user-supplied strings, including
title,tagline, andsubject, are interpolated directly into the master prompt template used to instruct the image generation model. This could be used to attempt to bypass the image model's safety filters.
Audit Metadata