guided-launch-announcement
Pass
Audited by Gen Agent Trust Hub on Sep 30, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill installs several Node.js packages (
@helios-project/core,@helios-project/renderer,@helios-project/cli) required for video composition and rendering. These are legitimate tools for the skill's stated purpose. - [DYNAMIC_EXECUTION]: The skill generates a local HTML/JavaScript file (
composition.html) and executes it using the Helios CLI to render a video. This dynamic generation and execution of code is the primary function of the skill. - [INDIRECT_PROMPT_INJECTION]: The skill ingests data from external URLs to perform brand research.
- Ingestion points: External marketing URLs provided by the user in Step 3.
- Boundary markers: Absent; the agent is simply instructed to fetch the URL and extract signals.
- Capability inventory: The skill has the ability to install npm packages, write local files, and execute shell commands via
npx. - Sanitization: No explicit sanitization or filtering of the fetched web content is defined before the agent processes it for brand identity extraction.
Audit Metadata