sillytavern-card-pipeline
Pass
Audited by Gen Agent Trust Hub on Oct 23, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill identifies and executes local project tools (e.g., build scripts, watchers) discovered in the repository. It mandates security measures to prevent command injection, such as passing arguments as separate process arguments instead of constructing shell strings, and performing read-only discovery of tool capabilities before use.
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from character cards and worldbooks. It addresses this risk through several defensive instructions:
- Ingestion points: Processes local card sources, worldbooks, and project manifests (e.g.,
SKILL.md,references/configuration-contracts.md). - Boundary markers: Instructions to separate model-visible content from developer commentary and to enforce specific acceptance gates for automated vs. human-accepted data.
- Capability inventory: The skill has the capability to write to the filesystem and execute subprocesses (e.g.,
pnpm). - Sanitization: It includes explicit instructions to validate all paths against an approved root to prevent directory traversal and to avoid unsafe shell concatenation during tool invocation.
Audit Metadata