skills/advibly/skills/song-ad/Gen Agent Trust Hub

song-ad

Pass

Audited by Gen Agent Trust Hub on Oct 8, 2026

Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [COMMAND_EXECUTION]: The skill instructs the agent to perform local file system operations and media processing using shell commands. \n
  • Evidence: In timing-and-slicing.md, the agent is provided with command templates for ffmpeg (audio conversion, trimming, and slicing), ffprobe (duration measurement), stat (file size checking), and curl (downloading source files and uploading processed slices). \n- [INDIRECT_PROMPT_INJECTION]: The skill exhibits an attack surface for indirect prompt injection by processing external data from the brand's profile and catalog. \n
  • Ingestion points: The skill pulls brand briefs, dossiers, and product catalogs using advibly_get_brand, advibly_get_brand_dossier, and advibly_get_products (SKILL.md). \n
  • Boundary markers: Absent. The instructions do not specify the use of delimiters or "ignore" warnings for the ingested brand data. \n
  • Capability inventory: The agent has the ability to execute shell commands (ffmpeg, curl), perform file system operations, and invoke various generative AI tools for music, image, and video creation. \n
  • Sanitization: Absent. There are no instructions for sanitizing or validating the content of the brand data before it is interpolated into prompts. \n- [EXTERNAL_DOWNLOADS]: The skill fetches generated audio assets from the vendor's platform. \n
  • Evidence: The skill uses curl to download song takes from URLs provided by the advibly_get_generation tool for local processing in timing-and-slicing.md.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 8, 2026, 09:49 PM