mascot-video
Pass
Audited by Gen Agent Trust Hub on Oct 15, 2026
Risk Level: SAFECOMMAND_EXECUTIONDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill utilizes shell commands to run local Python scripts (
python make.py) and a setup script (bash scripts/install_rhubarb.sh) included in the repository. - [DYNAMIC_EXECUTION]: The instructions direct the agent to modify Python configuration files (
mascots/<name>/mascot.py) which are subsequently interpreted during the execution of the video generation process. - [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted user input that could potentially contain malicious instructions.
- Ingestion points: User-supplied text prompts, script files, and audio recordings (SKILL.md).
- Boundary markers: The instructions do not define specific delimiters or guardrails for the user-provided data.
- Capability inventory: Shell command execution and Python script execution (SKILL.md).
- Sanitization: There is no mention of sanitization or validation for the user-provided text or file content.
Audit Metadata