storyboard-creation
Pass
Audited by Gen Agent Trust Hub on Jul 23, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill utilizes the belt CLI to perform image generation and stitching through shell commands. This execution is central to the skill's stated purpose of storyboarding.
- [EXTERNAL_DOWNLOADS]: The skill manages dependencies by fetching components from the inference-sh and belt-sh GitHub organizations via the npx skills add command. These sources are associated with the primary toolchain of the skill.
- [PROMPT_INJECTION]: The skill contains an indirect prompt injection surface. 1. Ingestion points: User-defined shot lists and scene descriptions in the workflow section. 2. Boundary markers: The instructions lack delimiters or constraints when passing user content into the belt command. 3. Capability inventory: The agent uses the Bash tool to execute belt commands. 4. Sanitization: No sanitization or validation steps are provided for the user-supplied prompt strings before command execution.
Audit Metadata