novel-art
Pass
Audited by Gen Agent Trust Hub on Sep 25, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill is a legitimate utility for AI short-drama art direction. Analysis of the Node.js scripts and instructions found no malicious patterns, unauthorized network activity, or credential theft attempts.
- [COMMAND_EXECUTION]: While the skill instructions involve shell commands, these are limited to executing its own local Node.js scripts for data processing, validation, and report rendering. No arbitrary or unsafe command execution patterns were detected.
- [INDIRECT_PROMPT_INJECTION]: The skill processes data from external JSON files (e.g.,
outline.json). The processing script includes anesc()function to sanitize data before rendering it into HTML reports, and uses Unicode escapes for embedded JSON, effectively mitigating injection vectors in the output reports. - [REMOTE_CODE_EXECUTION]: The implementation relies strictly on the Node.js standard library and explicitly avoids external dependencies, remote script fetching, or dynamic execution of untrusted code.
Audit Metadata