comic-creator

Pass

Audited by Gen Agent Trust Hub on Aug 11, 2026

Risk Level: SAFE
Full Analysis
  • [INDIRECT_PROMPT_INJECTION]: The skill exhibits an attack surface for indirect prompt injection as it processes untrusted user data (story ideas, scenarios, and files) through a multi-agent pipeline.
  • Ingestion points: User-provided topics, story ideas, and existing scenario/character files are extracted and saved to _workspace/00_input.md in Phase 1.
  • Boundary markers: The skill does not explicitly define delimiters or instructions for the agents to ignore potential instructions embedded within the user-provided comic scenarios.
  • Capability inventory: The agents have capabilities to write files to the local workspace (_workspace/), communicate via SendMessage, and trigger image generation via Gemini.
  • Sanitization: No explicit sanitization or validation of user-provided story content is documented before it is passed to the storyboarder or dialogue-writer agents.
  • [NO_CODE]: This skill consists entirely of high-level instructions and configuration for an agent team. It does not contain executable scripts, shell commands, or external dependencies, significantly reducing the technical attack surface.
Audit Metadata
Risk Level
SAFE
Analyzed
Aug 11, 2026, 08:03 AM
Security Audit — agent-trust-hub — comic-creator