paper-illustration
Pass
Audited by Gen Agent Trust Hub on Jul 18, 2026
Risk Level: SAFECOMMAND_EXECUTIONDATA_EXFILTRATIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill extensively uses shell scripts and Python heredocs to orchestrate its multi-stage workflow. These scripts perform filesystem operations (creating directories, writing files) and execute logic for API interaction and response parsing using bash and python3.
- [DATA_EXFILTRATION]: The skill performs network operations using curl to transmit prompt data and received generated content (text and images) to and from Google's Generative Language API (generativelanguage.googleapis.com). These operations involve the use of an environment-stored API key. Google is a well-known and recognized service provider, and the data transfer is necessary for the skill's primary function.
- [PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection because it interpolates user-provided arguments ($ARGUMENTS) directly into the initial planning prompt for Claude. Maliciously crafted input could potentially influence the agent's behavior or the figure generation logic.
- Ingestion points: User input provided via arguments in Step 1 of the workflow.
- Boundary markers: None. Input is directly embedded into the prompt template without delimiters or instructions to ignore embedded commands.
- Capability inventory: The skill has access to shell command execution (Bash), file writing (Write), and external network communication (curl).
- Sanitization: No specific sanitization or filtering of the user input is performed before it is used to construct LLM prompts.
Audit Metadata