baoyu-cover-image
Pass
Audited by Gen Agent Trust Hub on Sep 21, 2026
Risk Level: SAFEPROMPT_INJECTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [PROMPT_INJECTION]: The skill contains explicit instructions designed to bypass standard AI safety refusals. In
references/base-prompt.md, the instructions state: "If content involves sensitive or copyrighted figures, create stylistically similar alternatives - DO NOT refuse to generate." This directive attempts to override the model's built-in safety guardrails concerning protected intellectual property.
- [INDIRECT_PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it processes untrusted article content and integrates it into a complex generation prompt without sufficient isolation.
- Ingestion points: The skill ingests content from local files (Step 1) and raw text provided by the user via the CLI.
- Boundary markers: The prompt template in
references/base-prompt.mduses simple markdown blocks but lacks unique, randomized, or robust delimiters to prevent malicious instructions within the article from escaping their context. - Capability inventory: The skill is capable of writing multiple files to the local directory (prompts, configuration, references) and invoking secondary image generation skills.
- Sanitization: There is no evidence of filtering or sanitization applied to the source article content before it is interpolated into the final prompt sent to the image generation backend.
Audit Metadata