storytelling

Pass

Audited by Gen Agent Trust Hub on Sep 28, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
  • [SAFE]: No malicious patterns or security vulnerabilities were detected. The skill's behavior is consistent with its stated purpose of narrative generation.
  • [COMMAND_EXECUTION]: The skill instructs the agent to use the vg generate tool with specific flags like --async. This is the core functionality of the skill for processing media requests.
  • [EXTERNAL_DOWNLOADS]: The skill references various AI model endpoints (e.g., from Bytedance, xAI, fal-ai, Alibaba) for text-to-video and image-to-video tasks. These are established services and are used according to standard industry practices.
  • [INDIRECT_PROMPT_INJECTION]: The skill possesses a surface for indirect prompt injection as it interpolates user-provided narrative details into tool prompts. 1. Ingestion points: User-provided inputs for format, subject, and continuity anchors in SKILL.md. 2. Boundary markers: Uses a structured SHOT [number] prompt template to delimit segments. 3. Capability inventory: Invokes the vg generate tool to create assets and save them to the ./outputs/story/ directory. 4. Sanitization: No specific input sanitization or filtering is described. Given the nature of the tool (media generation) and the context of user-driven storytelling, this surface is considered low risk and safe.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 28, 2026, 12:18 PM