skills/busabase/templates/busa-drama/Gen Agent Trust Hub

busa-drama

Pass

Audited by Gen Agent Trust Hub on Oct 9, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill uses local scripts to download AI models and interface with external generation services.
  • scripts/execute_generation_requests.mjs downloads voice models from HuggingFace (mlx-community/Qwen3-TTS-12Hz-1.7B-VoiceDesign-8bit).
  • Generation requests are sent to established AI infrastructure domains: moonrouter.dev (Images API) and bytepluses.com (BytePlus/Ark Seedance).
  • These downloads and API references are documented and essential for the skill's primary functionality as a drama production workbench.
  • [COMMAND_EXECUTION]: Several automation scripts execute local commands via subprocesses to fulfill creative tasks.
  • scripts/execute_generation_requests.mjs spawns Python processes for voice synthesis and video drafting.
  • scripts/read_hyperframe_status.mjs executes ffprobe to determine media durations in local HyperFrame projects.
  • Command execution is handled via node:child_process (spawn/execFile) using argument arrays, which is a safe practice that prevents shell injection.
  • [INDIRECT_PROMPT_INJECTION]: The skill presents an attack surface for indirect prompt injection as it ingests untrusted creative data.
  • Ingestion points: Data enters the agent context through project.json records and local HyperFrame project files (HTML compositions and Markdown design notes) read by scripts/read_hyperframe_status.mjs.
  • Boundary markers: Standard schema fields and JSON structures are used, though explicit 'ignore instructions' delimiters for individual text fields are not consistently present in all templates.
  • Capability inventory: The skill has significant capabilities including network operations (AI APIs), local file writes, and subprocess execution.
  • Sanitization: UI-level HTML escaping is present, and internal data providers use schema-based normalization.
  • [DYNAMIC_EXECUTION]: The skill uses dynamic logic to assemble and execute generation tasks.
  • Automation scripts dynamically parse configuration settings from the Busabase database to determine which local Python environments or model checkouts to target for video and voice synthesis.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 9, 2026, 01:13 AM