comic-maker
Pass
Audited by Gen Agent Trust Hub on Oct 15, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill utilizes Python's
subprocessmodule inrender_codex.py,doctor.py, andsettings.pyto interact with system utilities. Specifically, it calls thecodexCLI to execute image generation tasks and thesipstool on macOS for image format conversion. These calls are restricted to expected CLI tools and are functional requirements for the skill's operation. - [INDIRECT_PROMPT_INJECTION]: The skill exhibits an attack surface for indirect prompt injection as its primary workflow involves reading and summarizing user-provided files or articles to generate comic scripts. This is a standard risk for content generation skills.
- Ingestion points:
SKILL.mddescribes a workflow where the agent reads user-provided articles or documents to extract core concepts (Step 1). - Boundary markers: The workflow does not explicitly define delimiters for external content during the initial summarization phase.
- Capability inventory: The skill possesses the capability to execute commands via the
codexCLI (render_codex.py) and write to the local file system (settings.py,_data.py). - Sanitization: The instructions focus on content extraction and formatting; no specific sanitization or escaping of the ingested text is documented before it is interpolated into internal prompts.
- [EXTERNAL_DOWNLOADS]: The documentation and setup scripts reference external dependencies, including the
Codex CLIand the PythonPillowlibrary. These are well-known developer tools and libraries required for the skill to perform image processing and generation.
Audit Metadata