eva-create
Pass
Audited by Gen Agent Trust Hub on Aug 21, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: No malicious patterns or security vulnerabilities were detected in the skill instructions. The skill utilizes a series of markdown files to guide the AI through content production phases, maintaining a focus on user-provided data and established content logic.
- [INDIRECT_PROMPT_INJECTION]: The skill exhibits an attack surface for indirect prompt injection as it is designed to process untrusted external data, such as benchmark copy and third-party materials.
- Ingestion points: The skill ingests "user files, pasted third-party content, screenshots, tables, Brief, or benchmark samples" primarily through the
eva-createentry point defined inSKILL.mdandreferences/create/shortvideo/00_eva-shortvideo_主入口.md. - Boundary markers: The skill explicitly instructs the agent to read
../eva-shared/references/shared/06_external-material-safety_外部材料安全边界.md(External Material Safety Boundary) specifically when processing external materials to mitigate risks. - Capability inventory: The skill is capable of generating structured content (scripts, articles) and creating persistent "Asset Cards" or "Memory Cards" (e.g.,
persona-card,voice-card,idea-card) which are stored in the agent's memory for future sessions. - Sanitization: The agent is instructed to perform expression authenticity reviews (
../eva-shared/references/quality/00_eva-ai-check_表达真实性审查.md) and follows a "Low Confidence Authorization" protocol (../eva-shared/references/shared/02_low-confidence_低置信度授权协议.md) to handle uncertain or unverified data.
Audit Metadata