vtuber-avatar-generation
Pass
Audited by Gen Agent Trust Hub on Apr 2, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSDATA_EXFILTRATION
Full Analysis
- [COMMAND_EXECUTION]: The skill utilizes
curlcommands to interact with the EachLabs API endpoint athttps://sense.eachlabs.run/chat. This is a standard method for API communication and is used here for its intended purpose of sending prompts and receiving generated asset data. - [EXTERNAL_DOWNLOADS]: The skill references external URLs for retrieving generated media, specifically from
https://storage.eachlabs.ai. As described in the SSE documentation, the agent is expected to handle image and video URLs returned by the generation service. - [DATA_EXFILTRATION]: The skill sends user-provided character descriptions and an API key (
$EACHLABS_API_KEY) to the vendor's API. This data transmission is the primary function of the skill and is directed to the official service infrastructure of the author. - [PROMPT_INJECTION]: The skill processes external data from the API's Server-Sent Events (SSE), which creates a surface for indirect prompt injection.
- Ingestion points: API responses from
https://sense.eachlabs.run/chatcontaining fields liketext_responseandthinking_delta(defined inreferences/SSE-EVENTS.md). - Boundary markers: None identified in the provided instructions.
- Capability inventory: Network requests via
curlas defined inSKILL.md. - Sanitization: Not explicitly defined in the provided documentation.
Audit Metadata