scenario-thumbnails

Pass

Audited by Gen Agent Trust Hub on Oct 17, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The instructions suggest that the agent ask the user to install additional tools from the scenario-labs/skills repository if they are missing. This points to the official vendor repository and requires manual user intervention rather than automated execution.- [INDIRECT_PROMPT_INJECTION]: The skill defines a surface for processing untrusted user data from thumbnail briefs and titles.
  • Ingestion points: Data enters via user requests for 'brief', 'topic', 'title', and 'exact copy' in SKILL.md.
  • Boundary markers: Instructions specify treating user-provided text as a 'contract' and mandate using specific composition roles.
  • Capability inventory: The skill uses tools like model_run for generation and model_scenario-compose-image for assembly.
  • Sanitization: Risks are mitigated by directing the agent to use scenario-text-overlay for text rendering, which ensures that supplied words are processed deterministically by a compositor rather than being interpreted as instructions by a generative model.- [SAFE]: No malicious code, obfuscation, or unauthorized access to sensitive files or credentials was detected. The skill focuses on adhering to user-provided asset references and maintaining identity consistency.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 17, 2026, 09:25 PM