paw-cra-design-batch
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTIONEXTERNAL_DOWNLOADSDYNAMIC_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill parses untrusted campaign briefs or content calendars to drive its generation pipeline.
- Ingestion points: Campaign brief and content calendar data ingested in SKILL.md and references/brief-intake.md.
- Boundary markers: Absent; there are no delimiters or instructions to ignore embedded commands within the input data.
- Capability inventory: Network access (curl), file system manipulation, and browser-based rendering (Puppeteer/Playwright).
- Sanitization: Absent; the skill does not mention sanitizing user-provided text before prompt interpolation or HTML rendering.
- [DYNAMIC_EXECUTION]: The skill uses Puppeteer or Playwright to render HTML/CSS templates using data from the ingested brief, as described in references/batch-generation.md. This headless browser environment could be exploited if malicious scripts are embedded in the campaign data.
- [COMMAND_EXECUTION]: Shell commands are used for image generation (curl) and media processing (ffmpeg). The curl command in references/batch-generation.md incorporates user-controlled strings into the request body, which could lead to injection if the underlying agent platform does not sanitize inputs.
- [EXTERNAL_DOWNLOADS]: The skill downloads generated assets from fal.ai (https://queue.fal.run), which is an established service and necessary for the skill's function.
Audit Metadata