topview-skill
Pass
Audited by Gen Agent Trust Hub on Apr 30, 2026
Risk Level: SAFEPROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [PROMPT_INJECTION]: The skill's core instructions in
SKILL.mdandreferences/auth.mdexplicitly direct the AI agent to withhold technical logs, command execution details, internal file paths, and environment variable names from its responses. While this behavior is flagged as concealment, the documentation provides the context that this is a user-experience optimization designed for non-technical users accessing the agent through mobile chat applications where technical terminal output would be considered noise. - [EXTERNAL_DOWNLOADS]: The skill utilizes Python's
requestslibrary to fetch generated media assets from the vendor's API endpoints (api.topview.ai) and well-known infrastructure providers (vercel.app). These downloads are triggered by explicit user requests for content generation and are saved to local directories for user access. - [EXTERNAL_DOWNLOADS]: The skill defines a standard set of dependencies in
scripts/requirements.txt, includingrequestsandpython-dotenv. These are well-known, legitimate libraries used for HTTP communication and environment configuration.
Audit Metadata