advibly-ugc-ads
Pass
Audited by Gen Agent Trust Hub on Jul 10, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill performs downloads of generated video assets using
curlfrom URLs retrieved through theadvibly_get_generationtool. - [COMMAND_EXECUTION]: The skill provides a shell script for the agent to execute in compatible environments (like Claude Code) to concatenate individual video clips into a final ad using
ffmpeg. - [PROMPT_INJECTION]: The skill exhibits an attack surface for indirect prompt injection by processing external data from a user's brand and product library to construct generation prompts and shell commands.
- Ingestion points: Data is pulled from the Advibly platform using
advibly_get_brand,advibly_get_brand_dossier, andadvibly_get_productsas described inSKILL.md. - Boundary markers: There are no specific delimiters or protective instructions provided to the agent to treat external brand data as untrusted content.
- Capability inventory: The skill utilizes shell execution for file management and video processing, as well as social media publishing capabilities via
advibly_social_create_post. - Sanitization: The instructions do not specify any validation or escaping mechanisms for the brand or product data before it is used in prompts or CLI commands.
Audit Metadata