skills/divakarwl12/story-to-animation-skills/generating-character-and-background-images/Gen Agent Trust Hub
generating-character-and-background-images
Pass
Audited by Gen Agent Trust Hub on Sep 4, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONDATA_EXFILTRATIONEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from local JSON files that is then used in prompts for external image generation.
- Ingestion points:
characters.jsonandbackgrounds.json(specifically thepromptfields) processed inscripts/generate_images.py. - Boundary markers: Absent; prompt strings are interpolated directly into the API request payload.
- Capability inventory: The script performs file writes to the project directory and network requests to third-party APIs.
- Sanitization: Absent; the script does not validate or sanitize the prompt strings before submission to the image generator.
- [DATA_EXFILTRATION]: The skill uploads generated images to
imgbb.com, a public third-party hosting service. While this facilitates permanent hosting for the pipeline, it constitutes data exposure to an external domain not on the standard whitelist. - [EXTERNAL_DOWNLOADS]: The script fetches image assets from
api.kie.aiduring the generation process and saves them to the localcharacters/andbackgrounds/directories. - [COMMAND_EXECUTION]: The skill requires the execution of a Python script that modifies local JSON files, creates environment configuration files, and communicates with external web services.
Audit Metadata