manga-drama
Pass
Audited by Gen Agent Trust Hub on Oct 2, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The scripts/generate_drama.py script interpolates user-provided data from the --theme argument and --script-file content directly into a system prompt for script generation. The absence of boundary markers or sanitization logic allows potential manipulation of the LLM's output. • Ingestion points: The --theme command-line argument and the content of the file specified by --script-file in scripts/generate_drama.py. • Boundary markers: None are employed in the generate_script function to separate user input from the system instructions. • Capability inventory: The skill possesses capabilities for reading local files, writing to the local filesystem, making network requests to the Volcengine API, and downloading files via urllib.request.urlretrieve. • Sanitization: The script does not perform any validation, escaping, or filtering of the external content before its interpolation into the prompt.
- [EXTERNAL_DOWNLOADS]: The skill fetches generated video content from Volcengine's official API endpoints using urllib.request.urlretrieve in scripts/generate_drama.py. These downloads are an expected part of the content generation workflow and originate from a well-known service provider.
Audit Metadata