cuelight-drama
Pass
Audited by Gen Agent Trust Hub on May 28, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill requires the installation of the
@cuelight/clitool from the NPM registry using the commandbun add -g @cuelight/cli. This package is the primary interface for the skill's production workflow. - [COMMAND_EXECUTION]: The skill's functionality is centered around executing shell commands via the
cuelight-cli. These commands handle data management, asset generation (images and videos), and project state tracking. - [PROMPT_INJECTION]: The skill contains an attack surface for indirect prompt injection (Category 8) as it ingests and processes untrusted user data such as novel scripts or source documents.
- Ingestion points: User-provided files are loaded into the workflow via commands like
cuelight-cli source draft create-from-fileandcuelight-cli episode set-script. - Boundary markers: No explicit delimiters or instructions to ignore embedded commands are present in the prompt templates when interpolating content.
- Capability inventory: The agent has access to shell execution, local file read/write within the
./.cuelight/directory, and network operations via the CLI tool. - Sanitization: Content sanitization is managed by the external CLI tool and the backend service it connects to.
Audit Metadata