quote-cards-and-text-graphics
Pass
Audited by Gen Agent Trust Hub on Oct 29, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONNO_CODE
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes user-provided text (quotes) to create designed graphics. It acknowledges the risk of prompt injection by including explicit instructions to treat input quotes as material rather than commands (stated in SKILL.md and references/scope-and-connections.md). This design indicates a security-conscious approach to handling untrusted input.
- Ingestion points: User-provided quotes or text lines ingested via prompt interaction (referenced in SKILL.md).
- Boundary markers: The skill instructs the agent to treat input as 'material, not a command,' although specific character delimiters are not defined in the provided text.
- Capability inventory: The skill description mentions the use of a design tool for rendering and WoopSocial for publishing, but no direct tool execution code or API scripts are included in the analyzed files.
- Sanitization: Instructions emphasize verifying wording and source to prevent fabrication or misattribution.
- [NO_CODE]: The skill consists entirely of Markdown and JSON configuration files. There are no executable scripts, shell commands, or binary files included, significantly reducing the attack surface for traditional code-based exploits.
- [SAFE]: No malicious patterns, obfuscation, unauthorized network operations, or persistence mechanisms were detected. The skill focuses on typographic craft and integrity, specifically prohibiting the fabrication or misattribution of quotes.
Audit Metadata