skills/advibly/skills/advibly-ugc-ads/Gen Agent Trust Hub

advibly-ugc-ads

Pass

Audited by Gen Agent Trust Hub on Jul 10, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill performs downloads of generated video assets using curl from URLs retrieved through the advibly_get_generation tool.
  • [COMMAND_EXECUTION]: The skill provides a shell script for the agent to execute in compatible environments (like Claude Code) to concatenate individual video clips into a final ad using ffmpeg.
  • [PROMPT_INJECTION]: The skill exhibits an attack surface for indirect prompt injection by processing external data from a user's brand and product library to construct generation prompts and shell commands.
  • Ingestion points: Data is pulled from the Advibly platform using advibly_get_brand, advibly_get_brand_dossier, and advibly_get_products as described in SKILL.md.
  • Boundary markers: There are no specific delimiters or protective instructions provided to the agent to treat external brand data as untrusted content.
  • Capability inventory: The skill utilizes shell execution for file management and video processing, as well as social media publishing capabilities via advibly_social_create_post.
  • Sanitization: The instructions do not specify any validation or escaping mechanisms for the brand or product data before it is used in prompts or CLI commands.
Audit Metadata
Risk Level
SAFE
Analyzed
Jul 10, 2026, 10:39 AM