baoyu-xhs-images
Pass
Audited by Gen Agent Trust Hub on Aug 21, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill instructs the agent to use shell commands such as
test,echo, andmkdirto manage configuration files and directory structures. These operations are restricted to the local project directory and a specific sub-folder in the user's home directory ($HOME/.baoyu-skills/). - [COMMAND_EXECUTION]: The skill executes a local script located at
${SKILL_DIR}/scripts/main.tsusing thebunruntime, which is invoked vianpxduring the image generation phase. - [EXTERNAL_DOWNLOADS]: The skill utilizes the
npxutility, which may download dependencies from the official npm registry, a well-known and trusted service, to facilitate script execution. - [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted user content to generate infographic prompts. It employs structured templates, frontmatter, and explicit section headers (e.g.,
## Content) to maintain clear boundaries and reduce the risk of the agent misinterpreting data as instructions.
Audit Metadata