storyboard-creation
Pass
Audited by Gen Agent Trust Hub on Sep 2, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill instructs the user to install the
belt-sh/clitool and references several related skills from theinference-shorganization on GitHub (e.g.,inference-sh/skills@ai-image-generation). These are the primary tools required for the skill to perform its intended task of AI image generation. - [COMMAND_EXECUTION]: The skill utilizes the
beltcommand-line interface to execute tasks on remote models, such asfalai/flux-dev-lorafor image generation andinfsh/stitch-imagesfor layout assembly. These commands are typical for the skill's stated purpose. - [INDIRECT_PROMPT_INJECTION]: The skill processes user-provided natural language descriptions to generate storyboard panels, creating an attack surface where malicious input could influence the image generation tool.
- Ingestion points: User-provided strings are interpolated into the
--inputJSON object for thebeltcommand inSKILL.md. - Boundary markers: None identified; input is passed directly into the tool's prompt field.
- Capability inventory: The skill is limited to executing the
belttool viaBashas defined in theallowed-toolsfrontmatter. - Sanitization: No sanitization or validation of the input strings is performed before they are sent to the remote API.
Audit Metadata