Storyteller Engine

Pass

Audited by Gen Agent Trust Hub on Mar 15, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill utilizes the storyteller-engine package, which is a vendor resource associated with the author, along with standard Python dependencies including openai, pandas, jinja2, and pydantic. It also recommends installing openpyxl for Excel support.
  • [COMMAND_EXECUTION]: The engine relies on external system utilities such as pandoc and wkhtmltopdf to handle the conversion of generated narratives into PDF format.
  • [PROMPT_INJECTION]: The skill presents a vulnerability surface for indirect prompt injection by design. It takes raw data from CSV, JSON, and Excel files and interpolates it into generative prompts using Jinja2 templates.
  • Ingestion points: The skill ingests untrusted data from files provided via the --input path as documented in SKILL.md.
  • Boundary markers: Absent; there are no specific delimiters or instructions defined to isolate the data content from the narrative generation instructions.
  • Capability inventory: The tool is capable of file system writes, performing network requests to the OpenAI API, and executing external system commands.
  • Sanitization: Absent; the documentation does not describe any validation or escaping of the data field content before it is processed into the final prompt for the AI model.
Audit Metadata
Risk Level
SAFE
Analyzed
Mar 15, 2026, 03:31 AM