viral-video-copywriting

Pass

Audited by Gen Agent Trust Hub on Jun 15, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill uses the requests library and the yt-dlp tool to fetch public video metadata (such as titles, descriptions, and subtitles) from Douyin (douyin.com). This is a well-known service, and the data being accessed is non-sensitive information intended for public consumption.
  • [COMMAND_EXECUTION]: The skill executes a local Python script, extract_douyin_video.py, using a shell command. This script is part of the skill's distribution and is used specifically to automate the extraction of metadata from video URLs provided by the user.
  • [PROMPT_INJECTION]: The skill contains an attack surface for indirect prompt injection as it ingests untrusted text from video metadata to perform its analysis. However, the risk is minimal as the skill's capabilities are limited to text processing and creative writing.
  • Ingestion points: Video titles, descriptions, and subtitles are fetched from external Douyin URLs via the extract_douyin_video.py script.
  • Boundary markers: The instructions do not define specific delimiters (like XML tags) to wrap the fetched content in the analysis prompt.
  • Capability inventory: Local Python script execution and natural language content generation.
  • Sanitization: The helper script performs basic regex-based filtering to remove hashtags and URLs from the extracted video descriptions before they are passed to the agent.
Audit Metadata
Risk Level
SAFE
Analyzed
Jun 15, 2026, 01:12 AM
Security Audit — agent-trust-hub — viral-video-copywriting