sillytavern-card-pipeline
Pass
Audited by Gen Agent Trust Hub on Sep 10, 2026
Risk Level: SAFECOMMAND_EXECUTIONDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill is designed to discover and execute shell commands and build tools found within a target repository (e.g.,
package.jsonscripts or build documentation). While the instructions include extensive safety guardrails, the execution of arbitrary commands found in a workspace is a sensitive capability. - [DYNAMIC_EXECUTION]: Instructions in
tool-adapter-contract.mdguide the agent to dynamically map project-specific capabilities to commands and argument templates at runtime based on documentation, usage text, and metadata found in the target directory. - [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from the target project, including build documentation, task definitions, and rolecard source files, which could theoretically influence agent behavior during the discovery phase.
- Ingestion points: The agent reads repository instructions, package scripts, task definitions, and schemas from the local project root to discover build capabilities (
tool-adapter-contract.md). - Boundary markers: The skill mandates the use of separate process arguments and explicitly forbids constructing shell strings from card paths or user content to prevent command injection (
tool-adapter-contract.md). - Capability inventory: The skill allows for local file system access (read/write for packaging) and the execution of external build processes via subprocess calls.
- Sanitization: The workflow requires UTF-8 integrity checks, syntax validation, and schema parsing at multiple verification gates before processing or packaging content (
release-gate.md).
Audit Metadata