tvc-storyboard
Pass
Audited by Gen Agent Trust Hub on Mar 25, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill integrates with the Volcengine Ark API using the official volcenginesdkarkruntime Python package to generate storyboard content. This is a legitimate use of a well-known service for the skill's primary purpose.\n- [SAFE]: Sensitive credentials like ARK_API_KEY are managed via environment variables rather than being hardcoded, following security best practices for secret management.\n- [SAFE]: The script accepts user-provided product information that is interpolated into the LLM prompt. While this is an ingestion surface for indirect content, the skill does not have high-privilege capabilities (such as arbitrary command execution) that could be exploited through prompt injection.\n- [SAFE]: File system operations are restricted to creating the necessary directories and writing the generated storyboard JSON to the output path specified by the user.
Audit Metadata