pixi-vn-narration
Pass
Audited by Gen Agent Trust Hub on Oct 20, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [SAFE]: The skill's primary focus is on documentation and providing examples for the Pixi'VN narration library. The code snippets provided are standard library usage patterns for visual novel development.
- [INDIRECT_PROMPT_INJECTION]: The skill describes an attack surface for indirect prompt injection through player input ingestion points (
narration.input.requestinSKILL.md) and AI-generated dialogue (ai.text.generateDialog). - Ingestion points: Player input values and AI-generated strings.
- Boundary markers: None explicitly documented for dialogue interpolation.
- Capability inventory: The engine can update dialogue, modify game storage, and control story flow via label jumps/calls.
- Sanitization: No explicit sanitization or escaping of these inputs is mentioned in the narration module documentation. This is a standard functional risk for interactive narrative engines and does not pose a threat to the execution environment.
- [EXTERNAL_DOWNLOADS]: The skill documents that the AI integration module (
@drincs/pixi-vn-ai) downloads local WebLLM models when initialized without options. These downloads facilitate local browser-based AI execution and originate from established sources compatible with the vendor's official feature set.
Audit Metadata