skills/kyh/vibedgames/storytelling/Gen Agent Trust Hub

storytelling

Pass

Audited by Gen Agent Trust Hub on Sep 17, 2026

Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
  • [INDIRECT_PROMPT_INJECTION]: The skill processes user-supplied narrative details and interpolates them into prompts for media generation models, creating a surface for indirect prompt injection.
  • Ingestion points: In SKILL.md, the agent is instructed to collect user inputs including 'Main subject', 'Character', 'Product', 'Location', 'Continuity anchors', and 'Visual prompt'.
  • Boundary markers: The instructions lack the use of delimiters or 'ignore' directives when placing user input into the prompt structures defined in the 'Prompt build order' section.
  • Capability inventory: The skill utilizes the vg generate tool to communicate with external AI endpoints (e.g., OpenAI, ByteDance, Alibaba) and performs file system writes to save generated assets to ./outputs/story/.
  • Sanitization: There are no sanitization or validation steps specified for the user-provided strings before they are incorporated into the executable prompts.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 17, 2026, 04:16 AM