draw-mascot
Pass
Audited by Gen Agent Trust Hub on Oct 15, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTIONCOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes user-supplied reference images that could contain embedded instructions or metadata designed to influence agent behavior during the code generation phase.
- Ingestion points: Reference images are ingested into the workspace via
python make.py new <name> --refs <image>as defined inSKILL.md. - Boundary markers: There are no specific instructions or delimiters provided to the agent to distinguish between visual character data and potential embedded textual instructions in the images.
- Capability inventory: The agent has the ability to write Python scripts (
draw.py,mascot.py) and execute them usingpython make.py draw, as well as access external voice design services. - Sanitization: The instructions do not specify any validation or sanitization steps for the image content or metadata before the agent processes them.
- [DYNAMIC_EXECUTION]: The skill requires the agent to generate Python source code (
mascots/<name>/draw.py) based on external inputs and then execute it. - The instructions direct the agent to "write
mascots/<name>/draw.py" and subsequently runpython make.py draw <name>andpython make.py check <name>to verify the output. - Although the agent is instructed to follow established local templates (e.g.,
mascots/sparky/draw.py), the pattern of writing and then executing code derived from untrusted inputs is a dynamic execution surface. - [COMMAND_EXECUTION]: The skill involves multiple shell command executions to manage the mascot build lifecycle, including creating directories, running drawing scripts, and performing validation checks.
- Evidence includes calls to
python make.py new,python make.py draw,python make.py check, andpython make.py video. - [EXTERNAL_DOWNLOADS]: The skill suggests installing an external library and using third-party voice services.
- It recommends
pip install skia-pythonfor graphics rendering. - It references using ElevenLabs Voice Design via
python make.py design-voicefor voice generation.
Audit Metadata