rive-interactive
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill documents how to process custom events and properties emitted from Rive animation files (.riv).
- Ingestion points: The skill in
SKILL.md(Pattern 4) andreferences/api_reference.mddemonstrates usingrive.on(EventType.RiveEvent, ...)to extract and act uponevent.dataandeventData.properties. - Boundary markers: The provided examples do not include delimiters or warnings to ignore instructions that might be embedded within the animation event data.
- Capability inventory: The included scripts (
component_generator.py,viewmodel_builder.py) are benign template generators with no network, file-writing, or execution capabilities beyond printing to the console. - Sanitization: Example code in
SKILL.mdshows raw data being used in alerts and console logs without validation or escaping, which could lead to unintended behavior if the animation file source is untrusted.
Audit Metadata