skill-battle
Pass
Audited by Gen Agent Trust Hub on Sep 21, 2026
Risk Level: SAFEDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [DYNAMIC_EXECUTION]: The script
scripts/render_card.pyutilizes__import__('os')to dynamically load theosmodule and access environment variables. Furthermore, the test suite intests/test_render_card.pyusesimportlib.utilandexec_moduleto load the script into the test environment. - [INDIRECT_PROMPT_INJECTION]: The skill acts as an ingestion surface for evaluation data which is processed and rendered into visual artifacts.
- Ingestion points: The
scripts/render_card.pyscript reads JSON-formatted experiment data from paths provided via command-line arguments. - Boundary markers: Not applicable for this data processing workflow.
- Capability inventory: The script has the capability to create directories and write SVG and PNG files to the local file system.
- Sanitization: The rendering logic uses
html.escapeto sanitize all text fields extracted from the input JSON before they are embedded in the SVG output, providing protection against injection in the generated files.
Audit Metadata