busabase-template-creator
Pass
Audited by Gen Agent Trust Hub on Sep 23, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill invokes
busabase-clifor format checking and a Python script (generate_cover.py) for generating visual assets. These operations are scoped to the template directory and are necessary for the skill's function as a publishing validator. - [EXTERNAL_DOWNLOADS]: References the
busabase-clitool (accessed via npx) and thebusabase/templatesGitHub repository. These are official vendor resources consistent with the 'busabase' author context and do not pose a security threat. - [INDIRECT_PROMPT_INJECTION]: The skill audits third-party template data. * Ingestion points: Processes
records.ndjsonfiles, template metadata, and screenshots. * Boundary markers: Absent from the provided instructions. * Capability inventory: Includes shell execution vianpx,python3, andffprobe. * Sanitization: Implements OCR-based validation to detect and remove upstream branding. * Risk: Low, as the skill functions as a diagnostic gate for developers rather than an automated execution environment for arbitrary data.
Audit Metadata