skills/lulu-eva/eva-skill/eva-create/Gen Agent Trust Hub

eva-create

Pass

Audited by Gen Agent Trust Hub on Aug 21, 2026

Risk Level: SAFE
Full Analysis
  • [SAFE]: No malicious patterns or security vulnerabilities were detected in the skill instructions. The skill utilizes a series of markdown files to guide the AI through content production phases, maintaining a focus on user-provided data and established content logic.
  • [INDIRECT_PROMPT_INJECTION]: The skill exhibits an attack surface for indirect prompt injection as it is designed to process untrusted external data, such as benchmark copy and third-party materials.
  • Ingestion points: The skill ingests "user files, pasted third-party content, screenshots, tables, Brief, or benchmark samples" primarily through the eva-create entry point defined in SKILL.md and references/create/shortvideo/00_eva-shortvideo_主入口.md.
  • Boundary markers: The skill explicitly instructs the agent to read ../eva-shared/references/shared/06_external-material-safety_外部材料安全边界.md (External Material Safety Boundary) specifically when processing external materials to mitigate risks.
  • Capability inventory: The skill is capable of generating structured content (scripts, articles) and creating persistent "Asset Cards" or "Memory Cards" (e.g., persona-card, voice-card, idea-card) which are stored in the agent's memory for future sessions.
  • Sanitization: The agent is instructed to perform expression authenticity reviews (../eva-shared/references/quality/00_eva-ai-check_表达真实性审查.md) and follows a "Low Confidence Authorization" protocol (../eva-shared/references/shared/02_low-confidence_低置信度授权协议.md) to handle uncertain or unverified data.
Audit Metadata
Risk Level
SAFE
Analyzed
Aug 21, 2026, 08:54 AM
Security Audit — agent-trust-hub — eva-create