generation-diversity

Pass

Audited by Gen Agent Trust Hub on Oct 25, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill provides instructions to download and install related generative components from the author's official GitHub repository (PrunaAI/pruna-skills) using the npx skills add command. These are vendor-owned resources used for modular skill management.
  • [COMMAND_EXECUTION]: The skill instructs the agent to perform local media operations using ffmpeg for clip concatenation and audio mixing, and to use the npx package runner to manage the installation of required skill dependencies.
  • [INDIRECT_PROMPT_INJECTION]: The skill creates a potential surface for indirect injection by ingesting untrusted user briefs (BRIEF.md or chat input) and interpolating that data into prompts for generative models.
  • Ingestion points: User-supplied creative briefs, brand manifests, and manifest log files (SKILL.md, references/clarification-intake.md).
  • Boundary markers: The skill suggests a 'brief lock' phase to verify user requirements but does not explicitly mandate strict delimiters (e.g., XML tags or unique markers) around user-supplied content within the generated prompts.
  • Capability inventory: The skill calls external generative APIs (POST /v1/predictions), executes local media assembly via ffmpeg, and performs network operations to poll for asset completion.
  • Sanitization: No explicit character escaping or safety filtering of the input brief is described before it is formatted into the final generative prompt.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 25, 2026, 08:52 AM