quality-posters
Pass
Audited by Gen Agent Trust Hub on Oct 9, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill relies on executing a local script
generate.jsvia Node.js to handle image generation tasks. The script is expected to be present in the project root. - [INDIRECT_PROMPT_INJECTION]: The skill ingests user-provided text ('brief') which is then passed as an argument to a shell command, creating a potential surface for indirect injection if not handled securely by the underlying agent platform.
- Ingestion points: User-supplied brief provided to the agent as described in
SKILL.md. - Boundary markers: The instructions use double quotes to encapsulate the user brief in the command execution examples.
- Capability inventory: The skill utilizes shell command execution to run
node generate.js. - Sanitization: The instructions do not detail specific sanitization or escaping protocols for the user input beyond the use of quotes.
Audit Metadata