skills/bria-ai/bria-skill/vgl/Gen Agent Trust Hub

vgl

Pass

Audited by Gen Agent Trust Hub on Oct 1, 2026

Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
  • [INDIRECT_PROMPT_INJECTION]: The skill is designed to translate natural language prompts into a structured VGL JSON format.
  • Ingestion points: User-supplied natural language descriptions are processed in SKILL.md to generate structured output.
  • Boundary markers: The skill does not explicitly define delimiters to separate user input from the agent's internal instructions.
  • Capability inventory: The skill contains instructions for formatting data to be sent via network tools, specifically the curl example in SKILL.md.
  • Sanitization: There are no specific validation or escaping instructions for the text fields within the JSON generation logic.
  • [COMMAND_EXECUTION]: The documentation provides a shell command example for interacting with the Bria API.
  • Evidence: SKILL.md includes a curl command targeting engine.prod.bria-api.com. This domain is associated with the skill's author (Bria AI) and uses the $BRIA_API_KEY environment variable placeholder, which is a standard and safe practice for secret management in documentation.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 1, 2026, 05:24 AM