couple-photo-shooting-planner
Pass
Audited by Gen Agent Trust Hub on Oct 31, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill ingests user-provided data, such as theme names and individual shot descriptions, which are then interpolated into detailed prompts for image generation tools.
- Ingestion points: Found in
scripts/shot_board.pythrough thecreateandselectcommands which process JSON input files. - Boundary markers: The skill uses YAML and Markdown templates to structure the prompts, providing clear separation between different data fields.
- Capability inventory: The skill generates structured
shot-detail-briefsfor downstream image generation tools but does not directly execute system-level commands with this data. - Sanitization: The skill uses
yaml.safe_dumpto ensure generated briefs are correctly formatted. - [DYNAMIC_EXECUTION]: The script
scripts/shot_board.pycontains a dynamic import call (__import__('math')) within thenormalize_panel_ratiofunction. This is used strictly to access the standard library's mathematical functions for calculating aspect ratio log-differences and does not allow for arbitrary code loading. - [COMMAND_EXECUTION]: The test file
tests/test_shot_board.pyusessubprocess.runto call the skill's own Python scripts viasys.executable. These operations are benign as they are confined to the local project environment for the purpose of automated testing and functional verification.
Audit Metadata