cola-avatar-pack
Pass
Audited by Gen Agent Trust Hub on Aug 30, 2026
Risk Level: SAFECOMMAND_EXECUTIONPERSISTENCEEXTERNAL_DOWNLOADSDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill uses shell commands to check the environment, manage files, and execute the provided image processing script. It includes a specific security section instructing the agent to validate variables like the name and URLs using regex to prevent command injection before they are interpolated into shell strings.
- [PERSISTENCE]: In Phase 8, the skill modifies the agent's core instructions (AGENT.md) to inject a new behavior block. This ensures the avatar-based emotional responses are persisted and active across different sessions and restarts.
- [EXTERNAL_DOWNLOADS]: The skill instructs the agent to install external Python packages (Pillow and rembg) and system packages (python3) if they are missing. It also downloads image assets generated by the listenhub service to the local file system.
- [DYNAMIC_EXECUTION]: The skill executes dynamic Python code using
python3 -cfor utility tasks, such as calculating the rarity tier of an avatar based on a name hash. - [INDIRECT_PROMPT_INJECTION]: The skill processes user-controlled input, specifically the agent's name and character details, to generate taglines and prompt descriptions. While this is an ingestion surface for untrusted data, the risk is mitigated by the skill's restrictive validation regex and the fact that the resulting text is used for static image rendering rather than influencing subsequent high-privilege agent decisions.
Audit Metadata