100x-visual-fission

Pass

Audited by Gen Agent Trust Hub on Aug 21, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill utilizes the official npm registry (registry.npmjs.org) to install the ajv package, which is a well-known and widely used library for JSON schema validation. This follows established secure package management practices.
  • [COMMAND_EXECUTION]: A local validation script (scripts/validate.js) is provided to enforce complex structural and logical constraints on generated prompt bundles. The skill provides clear instructions for the user or agent to execute this script via Node.js to verify the integrity of its outputs.
  • [PROMPT_INJECTION]: The skill implements strict internal instructions (axioms) to maintain identity consistency for characters and products across generated variations. No malicious instructions attempting to bypass safety filters or override agent behavior were found.
  • [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted user-provided content (product briefs and visual references) as its primary input. To mitigate the risk of marketing-oriented instructions influencing image generation results, it includes a comprehensive 'unvisualizable claim scan' that identifies and replaces non-visual marketing jargon with descriptive, photographable actions.
  • [DYNAMIC_EXECUTION]: The validation script utilizes ajv to compile and enforce a JSON schema at runtime. This is a standard and safe implementation for validating structured data models against the skill's specific output contract.
Audit Metadata
Risk Level
SAFE
Analyzed
Aug 21, 2026, 10:19 AM