cantian-naming
Pass
Audited by Gen Agent Trust Hub on Oct 17, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill executes local Node.js and TypeScript scripts, including
analyzeName.ts,pickName.ts, andpickNameByElement.ts, to analyze Chinese names and generate candidates. - [INDIRECT_PROMPT_INJECTION]: The skill ingests user-provided name and surname strings as inputs for its analysis logic.
- Ingestion points: Surname and given name strings are passed as command-line arguments to the analysis scripts.
- Boundary markers: Inputs are processed as distinct shell arguments within the command invocation.
- Capability inventory: The skill is limited to running local processing scripts and does not have network access or file-writing capabilities.
- Sanitization: The scripts implement strict validation, ensuring inputs are 1-2 characters in length and whitelisting characters against a local database in
data/hanzi.json; unauthorized characters result in immediate termination of the script. - [EXTERNAL_DOWNLOADS]: The installation instructions recommend fetching the
tsxpackage from the official NPM registry to support TypeScript execution in environments with older Node.js versions.
Audit Metadata