paper-collage-ad-codex
Fail
Audited by Gen Agent Trust Hub on Sep 16, 2026
Risk Level: HIGHEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill instructs users to clone and execute scripts from a repository under the
Jane-xiaoerGitHub account, which is not a recognized trusted organization or well-known service. - [COMMAND_EXECUTION]: Code examples such as
narrate-indextts2.mjsshow the use ofchild_process.execSyncwithshell: '/bin/bash'and direct string interpolation of manifest values (e.g.,${line.text}). This creates a critical command injection vulnerability where a maliciously crafted JSON manifest could execute arbitrary commands on the host system. - [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from storyboard and voice manifests which are then used in security-sensitive operations.
- Ingestion points: manifest files (
manifests/storyboard.json,manifests/voice.indextts2.json). - Boundary markers: None present to isolate data from instructions.
- Capability inventory: System command execution via FFmpeg and Python, local file system access, and network operations.
- Sanitization: No validation or escaping is applied to manifest fields before they are passed to shell executors.
Recommendations
- AI detected serious security threats
Audit Metadata