vgl
Pass
Audited by Gen Agent Trust Hub on Oct 1, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to translate natural language prompts into a structured VGL JSON format.
- Ingestion points: User-supplied natural language descriptions are processed in
SKILL.mdto generate structured output. - Boundary markers: The skill does not explicitly define delimiters to separate user input from the agent's internal instructions.
- Capability inventory: The skill contains instructions for formatting data to be sent via network tools, specifically the
curlexample inSKILL.md. - Sanitization: There are no specific validation or escaping instructions for the text fields within the JSON generation logic.
- [COMMAND_EXECUTION]: The documentation provides a shell command example for interacting with the Bria API.
- Evidence:
SKILL.mdincludes acurlcommand targetingengine.prod.bria-api.com. This domain is associated with the skill's author (Bria AI) and uses the$BRIA_API_KEYenvironment variable placeholder, which is a standard and safe practice for secret management in documentation.
Audit Metadata