Carousel Growth Engine
Pass
Audited by Gen Agent Trust Hub on Aug 11, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill orchestrates a series of shell and script files, including
generate-slides.sh,publish-carousel.sh, andanalyze-web.js, to manage the automated pipeline from research to publishing. - [EXTERNAL_DOWNLOADS]: The skill uses Playwright to perform website analysis, which requires downloading the Chromium browser engine via the standard
playwright install chromiumcommand. - [PROMPT_INJECTION]: The skill ingests data from external URLs through Playwright scraping. This introduces an indirect prompt injection surface where content from a target website could attempt to influence the carousel narrative or image generation prompts. However, this risk is inherent to the skill's primary function of analyzing third-party websites for marketing purposes, and the data is passed to image generation models rather than executable sinks.
- [DATA_EXFILTRATION]: The skill transmits generated images and metadata to the Upload-Post API for publishing. This network activity is the intended core functionality for social media distribution and does not involve the exfiltration of sensitive local files or credentials.
Audit Metadata