Skills
skills/chouchiu/heya-skill/heya-title-style/Gen Agent Trust Hub

heya-title-style

Pass

Audited by Gen Agent Trust Hub on Jul 4, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
  • [PROMPT_INJECTION]: Adopts a specific persona and uses data-driven learning to generate catchy titles, which is standard roleplay for this content creation task.\n- [PROMPT_INJECTION]: Potential attack surface for indirect prompt injection through external data ingestion.\n
  • Ingestion points: scripts/fetch-bilibili-titles.ts fetches Bilibili video titles via the uapis.cn API into references/research/01-titles.json.\n
  • Boundary markers: Present. The data is injected into SKILL.md inside specific <!-- AUTO_START --> marker tags and markdown structures.\n
  • Capability inventory: Maintenance scripts use spawnSync and writeFileSync to manage and analyze datasets.\n
  • Sanitization: Absent. External title strings are incorporated directly into reference data without filtering for potential malicious instructions.\n- [EXTERNAL_DOWNLOADS]: Fetches Bilibili video metadata from the uapis.cn API service. This is the intended data source for the skill's style learning functionality.\n- [COMMAND_EXECUTION]: Recommends the use of npx skills update and bun pipeline to refresh and analyze the local writing style datasets.
Audit Metadata
Risk Level
SAFE
Analyzed
Jul 4, 2026, 02:13 PM
Security Audit — agent-trust-hub — heya-title-style