sillytavern-rolecard-performance
Pass
Audited by Gen Agent Trust Hub on Sep 10, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill uses local Node.js scripts to perform structural analysis of JSON files. These scripts (
measure-rolecard-performance.mjs,check-performance-budget.mjs, andvalidate-runtime-sample.mjs) use standard Node.js libraries (fs,path,crypto,url) and do not include any external or unverifiable dependencies. - [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted JSON rolecard data via the
--cardparameter. However, the implementation includes a robust redaction mechanism that ensures only metadata (counts, byte lengths) is recorded. The actual content of prompts, scripts, and URLs is never echoed to output or reports, mitigating the risk of processing malicious instructions embedded in the rolecards. Ingestion points:scripts/measure-rolecard-performance.mjsreads the input file. Boundary markers: The script operates on the JSON structure directly; no specific boundary markers are used for the content as it is redacted. Capability inventory: File reading (fs.readFileSync) and writing (fs.writeFileSync). Sanitization: All string values, scripts, and URLs are excluded from the output reports.
Audit Metadata