model-office
Pass
Audited by Gen Agent Trust Hub on Aug 20, 2026
Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The orchestration script
scripts/run.pyinitiates the local FastAPI backend (scripts/server.py) usingsubprocess.Popen. This is a functional requirement to host the pixel-art visualization dashboard onhttp://127.0.0.1:8787. - [INDIRECT_PROMPT_INJECTION]: The skill processes user-defined tasks which are interpolated into a dispatcher prompt. While the skill lacks explicit boundary markers or sanitization for this untrusted data, the capabilities are restricted to generating visualization events and making standard API calls to configured LLM providers (Anthropic, OpenAI, and Perplexity).
Audit Metadata