paper-collage-ad-production
Fail
Audited by Gen Agent Trust Hub on Sep 16, 2026
Risk Level: HIGHCOMMAND_EXECUTIONDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The utility script
scripts/full-pipeline.mjsutilizeschild_process.execSyncto run a sequence of commands. It performs direct string interpolation of thePROJECTvariable, obtained from command-line arguments, into the execution string. This pattern is highly susceptible to command injection attacks if a project path containing shell metacharacters is provided. - [DYNAMIC_EXECUTION]: The skill uses a central Node.js script to dynamically assemble and execute shell commands for processing storyboard frames and animation segments.
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted product materials and brand assets to generate visual metaphors and color palettes. 1. Ingestion points: Product materials for visual metaphor extraction and
assets/brand/logo.pngfor color palette extraction. 2. Boundary markers: Absent. 3. Capability inventory: Use ofchild_process.execSyncfor shell command execution inscripts/full-pipeline.mjs. 4. Sanitization: No evidence of input filtering or escaping for ingested content.
Recommendations
- AI detected serious security threats
Audit Metadata