skills/zapabob/skills/yukkuri-movie/Gen Agent Trust Hub

yukkuri-movie

Pass

Audited by Gen Agent Trust Hub on Sep 5, 2026

Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
  • [SAFE]: The skill implements legitimate functionality for VTuber content creation using YukkuriMovieMaker (YMM4). It defines a standard set of project management and animation capabilities.- [COMMAND_EXECUTION]: The agent is configured to use tools such as bash, python, and git to automate local workflows. These tools are appropriate for the skill's stated purpose of managing project files and triggering local rendering processes.- [INDIRECT_PROMPT_INJECTION]: The skill processes user-provided project files and assets which could potentially contain instructions intended to influence agent behavior.
  • Ingestion points: The agent reads project configurations (*.ymmp) and asset files from the working directory as described in SKILL.md and agents/openai.yaml.
  • Boundary markers: The system prompt does not define specific delimiters or instructions to disregard potential commands embedded within project data.
  • Capability inventory: The agent possesses high-privilege capabilities including bash execution and file writing (agents/openai.yaml).
  • Sanitization: The instructions lack explicit mechanisms to sanitize or validate the content of external project files before they are processed by the agent.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 5, 2026, 12:07 PM