yyl-video-prompt
Pass
Audited by Gen Agent Trust Hub on Oct 1, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill provides and executes a local Python script,
scripts/prompt_builder.py, to validate the structure, timecodes, and internal consistency of generated video prompts. This script is bundled with the skill and uses standard Python libraries to perform regex-based text analysis and structural checks, with no detected network or unauthorized file access. - [INDIRECT_PROMPT_INJECTION]: The skill is designed to process untrusted user-supplied scripts and storyboards, interpolating this data into complex prompt templates. While it implements structural validation and uses specific boundary markers (e.g.,
【全文地图】,【人物一致性】,【硬约束】) to maintain context, it remains susceptible to indirect prompt injection where instructions embedded in the input data could influence agent behavior. Evidence chain: 1. Ingestion points: User scripts and ideas processed viaSKILL.md. 2. Boundary markers: Present in the form of structured Chinese section headers. 3. Capability inventory: Local script execution and high-complexity text generation. 4. Sanitization: Structural and timing validation performed by theprompt_builder.pyscript.
Audit Metadata