pesty-explainer
Pass
Audited by Gen Agent Trust Hub on Oct 15, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill retrieves data from external web sources and user-supplied files, then uses this content to construct a storyboard and generate Python code for video rendering.
- Ingestion points:
SKILL.mdStep 2 describes gathering proof from user sources and web searches. - Boundary markers: No specific delimiters or safety instructions are defined to prevent the agent from following malicious instructions hidden within the ingested data during the script generation phase.
- Capability inventory: The skill environment allows for shell command execution, Python script generation, and media rendering using Manim.
- Sanitization: There are no explicit instructions for sanitizing or escaping the external data before it is written into the
scenes.pyscript. - [DYNAMIC_EXECUTION]: The skill generates and runs Python code (
scenes.py) at runtime to produce video frames. - Evidence:
SKILL.mdStep 5 instructs the agent to write and execute ascenes.pyfile using the Manim engine. - [EXTERNAL_DOWNLOADS]: The skill installs dependencies from the author's GitHub repository.
- Evidence:
SKILL.mdprovides an installation command usingnpxtargetingPesty-Marketing/agent-skills. This reference to the vendor's own repository is documented neutrally.
Audit Metadata