gsp-art
Pass
Audited by Gen Agent Trust Hub on Apr 11, 2026
Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill uses the
Bashtool to executenode -ecommands. This is used to render and verify the visual alignment and color of agent-generated ASCII/Unicode art snippets. - [PROMPT_INJECTION]: The skill is subject to indirect prompt injection (Category 8) because it ingests untrusted user input to guide the generation of content that is then executed.
- Ingestion points: User input for art subject, mood, and size is gathered via
AskUserQuestioninSKILL.md. - Boundary markers: Absent. There are no instructions or delimiters provided to ensure that user-provided concepts do not escape the intended string context during art generation.
- Capability inventory: The skill has the
Bashtool allowed and uses it to execute arbitrary strings vianode -e. - Sanitization: Absent. The process does not include steps to sanitize or escape user-provided strings before they are incorporated into the executable art templates.
Audit Metadata