draw-mascot

Pass

Audited by Gen Agent Trust Hub on Oct 15, 2026

Risk Level: SAFEINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTIONCOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [INDIRECT_PROMPT_INJECTION]: The skill processes user-supplied reference images that could contain embedded instructions or metadata designed to influence agent behavior during the code generation phase.
  • Ingestion points: Reference images are ingested into the workspace via python make.py new <name> --refs <image> as defined in SKILL.md.
  • Boundary markers: There are no specific instructions or delimiters provided to the agent to distinguish between visual character data and potential embedded textual instructions in the images.
  • Capability inventory: The agent has the ability to write Python scripts (draw.py, mascot.py) and execute them using python make.py draw, as well as access external voice design services.
  • Sanitization: The instructions do not specify any validation or sanitization steps for the image content or metadata before the agent processes them.
  • [DYNAMIC_EXECUTION]: The skill requires the agent to generate Python source code (mascots/<name>/draw.py) based on external inputs and then execute it.
  • The instructions direct the agent to "write mascots/<name>/draw.py" and subsequently run python make.py draw <name> and python make.py check <name> to verify the output.
  • Although the agent is instructed to follow established local templates (e.g., mascots/sparky/draw.py), the pattern of writing and then executing code derived from untrusted inputs is a dynamic execution surface.
  • [COMMAND_EXECUTION]: The skill involves multiple shell command executions to manage the mascot build lifecycle, including creating directories, running drawing scripts, and performing validation checks.
  • Evidence includes calls to python make.py new, python make.py draw, python make.py check, and python make.py video.
  • [EXTERNAL_DOWNLOADS]: The skill suggests installing an external library and using third-party voice services.
  • It recommends pip install skia-python for graphics rendering.
  • It references using ElevenLabs Voice Design via python make.py design-voice for voice generation.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 15, 2026, 04:43 PM