lov-article-creator

Pass

Audited by Gen Agent Trust Hub on Sep 3, 2026

Risk Level: SAFE
Full Analysis
  • [SAFE]: The skill provides a robust, multi-module architecture for professional content creation with no evidence of malicious intent or behavior. It emphasizes factual integrity and includes mechanisms to prevent AI-generated artifacts from compromising publication standards.
  • [COMMAND_EXECUTION]: Local Python scripts are used for automation tasks such as validating skill structure (validate_skill.py), composing brand assets onto images (compose_covers.py), and building package manifests (build_article_package.py). These scripts are self-contained, perform only local file system operations, and do not invoke external shell commands or network utilities.
  • [DATA_EXPOSURE]: Brand identity and user preferences are managed through a user profile system. The profile_store.py script specifically includes a safety filter (SENSITIVE_PARTS) that prevents the persistence of sensitive keys like 'token', 'secret', 'password', or 'api_key', ensuring credentials are not accidentally stored in shared brand configurations.
  • [INDIRECT_PROMPT_INJECTION]: As the skill processes research materials and external drafts, it implements a 'truth ledger' and 'reader contract' workflow. This strategy isolates input data from the agent's internal operational context. Furthermore, the validate_article_package.py script includes a regression test for session context leaks, specifically looking for phrases that indicate the model is obeying instructions from a previous turn rather than the input facts.
  • [EXTERNAL_DOWNLOADS]: The skill identifies 'Pillow' and 'PyYAML' as its primary dependencies and utilizes local assets or host-integrated image generation. It does not perform any unverified remote script execution or external binary downloads.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 3, 2026, 10:22 AM