busa-drama
Pass
Audited by Gen Agent Trust Hub on Oct 9, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill uses local scripts to download AI models and interface with external generation services.
scripts/execute_generation_requests.mjsdownloads voice models from HuggingFace (mlx-community/Qwen3-TTS-12Hz-1.7B-VoiceDesign-8bit).- Generation requests are sent to established AI infrastructure domains:
moonrouter.dev(Images API) andbytepluses.com(BytePlus/Ark Seedance). - These downloads and API references are documented and essential for the skill's primary functionality as a drama production workbench.
- [COMMAND_EXECUTION]: Several automation scripts execute local commands via subprocesses to fulfill creative tasks.
scripts/execute_generation_requests.mjsspawns Python processes for voice synthesis and video drafting.scripts/read_hyperframe_status.mjsexecutesffprobeto determine media durations in local HyperFrame projects.- Command execution is handled via
node:child_process(spawn/execFile) using argument arrays, which is a safe practice that prevents shell injection. - [INDIRECT_PROMPT_INJECTION]: The skill presents an attack surface for indirect prompt injection as it ingests untrusted creative data.
- Ingestion points: Data enters the agent context through
project.jsonrecords and local HyperFrame project files (HTML compositions and Markdown design notes) read byscripts/read_hyperframe_status.mjs. - Boundary markers: Standard schema fields and JSON structures are used, though explicit 'ignore instructions' delimiters for individual text fields are not consistently present in all templates.
- Capability inventory: The skill has significant capabilities including network operations (AI APIs), local file writes, and subprocess execution.
- Sanitization: UI-level HTML escaping is present, and internal data providers use schema-based normalization.
- [DYNAMIC_EXECUTION]: The skill uses dynamic logic to assemble and execute generation tasks.
- Automation scripts dynamically parse configuration settings from the Busabase database to determine which local Python environments or model checkouts to target for video and voice synthesis.
Audit Metadata