couple-photo-shooting-planner

Pass

Audited by Gen Agent Trust Hub on Oct 31, 2026

Risk Level: SAFEINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTIONCOMMAND_EXECUTION
Full Analysis
  • [INDIRECT_PROMPT_INJECTION]: The skill ingests user-provided data, such as theme names and individual shot descriptions, which are then interpolated into detailed prompts for image generation tools.
  • Ingestion points: Found in scripts/shot_board.py through the create and select commands which process JSON input files.
  • Boundary markers: The skill uses YAML and Markdown templates to structure the prompts, providing clear separation between different data fields.
  • Capability inventory: The skill generates structured shot-detail-briefs for downstream image generation tools but does not directly execute system-level commands with this data.
  • Sanitization: The skill uses yaml.safe_dump to ensure generated briefs are correctly formatted.
  • [DYNAMIC_EXECUTION]: The script scripts/shot_board.py contains a dynamic import call (__import__('math')) within the normalize_panel_ratio function. This is used strictly to access the standard library's mathematical functions for calculating aspect ratio log-differences and does not allow for arbitrary code loading.
  • [COMMAND_EXECUTION]: The test file tests/test_shot_board.py uses subprocess.run to call the skill's own Python scripts via sys.executable. These operations are benign as they are confined to the local project environment for the purpose of automated testing and functional verification.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 31, 2026, 11:41 AM