character-card-v3-generator
Pass
Audited by Gen Agent Trust Hub on Sep 14, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [SAFE]: The skill implements the Character Card V3 specification through structured templates and guidelines. It demonstrates secure coding practices by separating generated artifacts from commentary and providing clear safety and review rubrics in 'references/reviewing-cards.md'.
- [COMMAND_EXECUTION]: The skill uses a local Python script, 'scripts/validate_card.py', to verify the structural integrity of generated JSON files. Technical analysis of the script confirms it uses only standard Python libraries (json, sys, pathlib, typing), performs no network operations, and does not execute arbitrary code.
- [EXTERNAL_DOWNLOADS]: The documentation references external resources for character design and technical specifications, including official GitHub repositories, SillyTavern documentation, and community discussion platforms like Reddit and HuggingFace. These are recognized community resources and are used for informational purposes only.
- [INDIRECT_PROMPT_INJECTION]: The skill processes user-supplied character concepts to generate card content. While this creates a data ingestion surface, the skill explicitly mitigates prompt injection risks by providing a comprehensive 'Safety and Leakage' checklist in 'references/reviewing-cards.md' to ensure generated instructions do not cause unintended agent behavior or leak hidden state.
Audit Metadata