movie-poster-graphics
Warn
Audited by Gen Agent Trust Hub on Oct 2, 2026
Risk Level: MEDIUMEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill recommends using
npx minibanana@0.1.0as a wrapper for OpenRouter access. This command downloads and executes a package from the public npm registry at runtime. The package is not published by the skill author (skillatlas) or a recognized trusted organization. - [COMMAND_EXECUTION]: The skill provides specific shell command patterns for executing external packages to perform network operations and image generation tasks.
- [INDIRECT_PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it incorporates user-derived concepts into the prompts sent to AI image models.
- Ingestion points: User requests are used to generate
[CONCEPT_DESCRIPTION],[TITLE], and[TAGLINE]variables inSKILL.md. - Boundary markers: The skill uses quotes around title and tagline text in its final prompt formula, which provides only minor protection against adversarial input.
- Capability inventory: The skill possesses shell execution capabilities and network access to third-party image generation APIs.
- Sanitization: There are no instructions for sanitizing or filtering user-provided concept descriptions before they are interpolated into the final prompt.
- [DYNAMIC_EXECUTION]: The skill involves generating prompt files (e.g.,
@poster-prompt.md) at runtime to be used as input for theminibananaexecution tool.
Audit Metadata