avatar
Pass
Audited by Gen Agent Trust Hub on Nov 5, 2026
Risk Level: SAFEDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [DYNAMIC_EXECUTION]: The skill instructs the agent to execute a provided script (
sheet.js) within a browser environment via an evaluation tool. This script is used to capture animation frames and display them in a visual "contact sheet" for verification purposes. The script is bundled with the skill and its behavior is limited to DOM manipulation for testing visibility. - [INDIRECT_PROMPT_INJECTION]: The instructions require the agent to analyze user-provided reference characters by opening their source material. While this establishes a data ingestion surface, the instructions specifically restrict the agent's task to measuring technical geometric and timing parameters, which mitigates the risk of following arbitrary instructions embedded in external content.
Audit Metadata