neta-character
Pass
Audited by Gen Agent Trust Hub on Apr 3, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes character management commands using npx to run the @talesofai/neta-skills package. These commands allow for creating, updating, and querying character data as part of the intended workflow.
- [EXTERNAL_DOWNLOADS]: The skill retrieves the @talesofai/neta-skills package from the NPM registry at runtime. This dependency is owned by the skill's author.
- [PROMPT_INJECTION]: The skill exhibits an indirect prompt injection surface as it handles and retrieves user-defined character attributes like descriptions and personas.
- Ingestion points: Character metadata fields such as 'description' and 'persona' in SKILL.md and creation guides.
- Boundary markers: No specific delimiters are defined to separate character data from agent instructions.
- Capability inventory: The skill uses npx for shell command execution.
- Sanitization: No sanitization or validation of character text fields is mentioned in the guides.
Audit Metadata