tvc-color-grading
Pass
Audited by Gen Agent Trust Hub on Sep 18, 2026
Risk Level: SAFE
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill ingests user-supplied values for mood and reference brand names in
scripts/generate_color_grade.py. These inputs are interpolated into a JSON output. - Ingestion points:
--moodand--referencearguments inscripts/generate_color_grade.py. - Boundary markers: Absent; inputs are directly assigned to JSON keys.
- Capability inventory: Local file writing and directory creation in
scripts/generate_color_grade.py. - Sanitization: Absent; raw strings are used. While this represents a surface for indirect prompt injection, the specific use case and structured JSON output format mitigate the risk.
- [COMMAND_EXECUTION]: The skill invokes
scripts/generate_color_grade.pyviapython3. The script is bundled with the skill and performs deterministic mapping of industry categories to color palettes without dynamic execution or dangerous system calls. - [CREDENTIALS_UNSAFE]: The skill's metadata requires the
ARK_API_KEYenvironment variable. This is a standard platform requirement for the intended agent execution environment and does not constitute a credential leak or unsafe storage.
Audit Metadata