manga-drama

Pass

Audited by Gen Agent Trust Hub on Oct 2, 2026

Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [INDIRECT_PROMPT_INJECTION]: The scripts/generate_drama.py script interpolates user-provided data from the --theme argument and --script-file content directly into a system prompt for script generation. The absence of boundary markers or sanitization logic allows potential manipulation of the LLM's output. • Ingestion points: The --theme command-line argument and the content of the file specified by --script-file in scripts/generate_drama.py. • Boundary markers: None are employed in the generate_script function to separate user input from the system instructions. • Capability inventory: The skill possesses capabilities for reading local files, writing to the local filesystem, making network requests to the Volcengine API, and downloading files via urllib.request.urlretrieve. • Sanitization: The script does not perform any validation, escaping, or filtering of the external content before its interpolation into the prompt.
  • [EXTERNAL_DOWNLOADS]: The skill fetches generated video content from Volcengine's official API endpoints using urllib.request.urlretrieve in scripts/generate_drama.py. These downloads are an expected part of the content generation workflow and originate from a well-known service provider.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 2, 2026, 03:24 PM