huashu-design
Pass
Audited by Gen Agent Trust Hub on Sep 20, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill exhibits an indirect prompt injection attack surface as it processes untrusted user prompts to generate and execute HTML/React code.
- Ingestion points: User-supplied prompts used to drive the design process (SKILL.md), external image metadata fetched from Wikimedia (fetch_images.py), and results from WebSearch calls.
- Boundary markers: Absent. The skill does not implement delimiters or explicit instructions for the agent to ignore embedded commands within user-provided content.
- Capability inventory: Includes shell command execution (via various scripts in scripts/), file system write access for saving generated designs, and web searching.
- Sanitization: No filtering or escaping of user-provided strings is performed before they are interpolated into the generated HTML output.
- [EXTERNAL_DOWNLOADS]: The skill references and downloads resources from well-known and reputable services.
- Fetches core runtime libraries (React, ReactDOM, Babel Standalone) from unpkg.com for in-browser execution.
- Retrieves public domain images and metadata from wikimedia.org (scripts/fetch_images.py).
- Utilizes ByteDance's official openspeech API for Text-to-Speech functionality (scripts/tts-doubao.mjs).
- [COMMAND_EXECUTION]: The skill uses local shell and Node.js scripts to automate design and export workflows.
- Executing ffmpeg and ffprobe for video processing and audio mixing (scripts/convert-formats.sh, scripts/add-music.sh, etc.).
- Uses Playwright to automate browser-based rendering and validation (scripts/render-video.js, scripts/verify.py).
Audit Metadata