tvc-hook-generator
Pass
Audited by Gen Agent Trust Hub on Mar 25, 2026
Risk Level: SAFEPROMPT_INJECTIONEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [PROMPT_INJECTION]: The skill has a surface for indirect prompt injection through processed data.
- Ingestion points: Untrusted data enters via the
--product-infoCLI argument inscripts/generate_hook.py. - Boundary markers: Absent; the product info is interpolated directly into the LLM prompt.
- Capability inventory: The script performs file-write operations in
scripts/generate_hook.pyusing the user-provided output path. - Sanitization: No specific sanitization or escaping of the product info is performed before interpolation.
- [EXTERNAL_DOWNLOADS]: The skill depends on the
volcenginesdkarkruntimelibrary, which is the official SDK for the Volcengine (ByteDance) Ark platform, a well-known technology service. - [COMMAND_EXECUTION]: The script performs file system operations, creating directories and writing generated output to the user-specified path.
Audit Metadata