story-roleplay
Pass
Audited by Gen Agent Trust Hub on Aug 16, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill provides a legitimate utility for parsing roleplay character cards. The code handles file operations locally and does not perform any network requests or exfiltrate data.
- [COMMAND_EXECUTION]: The skill instructions include shell commands for copying files (
cp), searching for scripts (find), and installing dependencies (npm install). These are routine development tasks within the intended scope of the skill's setup and do not involve privilege escalation or obfuscated commands. - [EXTERNAL_DOWNLOADS]: The skill uses
npm installto fetch standard packages (png-chunks-extract,png-chunk-text) from the official NPM registry. These are well-known, targeted dependencies for the specific task of PNG chunk processing. - [INDIRECT_PROMPT_INJECTION]: The skill processes external data (PNG metadata). It mitigates risks by explicitly forbidding the agent from guessing content, requiring the use of a parser tool, and converting extracted data into structured JSON for review. Boundary markers and clear error handling are implemented.
Audit Metadata