shotlist
Pass
Audited by Gen Agent Trust Hub on Nov 9, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [SAFE]: Analysis of the skill's instructions and data files across 11 threat categories revealed no malicious patterns or security risks. The skill's behavior is entirely aligned with its objective of aiding in the storyboard creation process.
- [COMMAND_EXECUTION]: The skill includes two local Python scripts,
scripts/draw_techniques.pyandscripts/precedent.py, which the agent is instructed to run to automate the selection of animation techniques and retrieval of design rules. Static analysis of these scripts confirms they are benign and only use standard Python libraries to process local JSON data. - [INDIRECT_PROMPT_INJECTION]: The skill instructions involve reading user-provided project files such as
brief.mdandstyle-guide.md. While this exposes a potential surface for indirect prompt injection, the skill lacks high-risk capabilities—such as network access or file-system modifications—that would allow for exploitation. - [EXTERNAL_DOWNLOADS]: The skill's documentation contains various links to supplementary design guidelines hosted on the author's official GitHub repository. These references are for documentation purposes and do not facilitate the automated download or execution of remote code.
Audit Metadata