pixi-vn-ink-characters
Pass
Audited by Gen Agent Trust Hub on Nov 10, 2026
Risk Level: SAFE
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill implements a character renaming feature (
# rename) that accepts user-provided input strings. While this creates a potential surface for indirect prompt injection if the character name is later processed by an LLM without isolation, the implementation includes schema validation using thezodlibrary. This is a standard feature of the visual novel engine and is considered a low-risk, intended functionality. - Ingestion points: User input via the
_input_value_variable in Ink scripts interpolated into the# renamecommand. - Boundary markers: The system uses a specific hashtag command syntax to delimit the instruction.
- Capability inventory: The skill allows updating the
nameproperty of aCharacterBaseModelobject in memory. - Sanitization: Uses
zod.string()validation to ensure the input is a valid string type. - [EXTERNAL_DOWNLOADS]: The skill references dependencies and packages such as
@drincs/pixi-vnand@drincs-productions/pixi-vn-ink. These are official, vendor-owned resources for the Pixi'VN framework and represent legitimate project components. - [COMMAND_EXECUTION]: No dangerous command execution patterns or unauthorized shell access mechanisms were detected. The code snippets provided are for standard narrative game logic.
Audit Metadata