video-sharing
Pass
Audited by Gen Agent Trust Hub on Jul 13, 2026
Risk Level: SAFEPROMPT_INJECTION
Full Analysis
- [PROMPT_INJECTION]: The skill provides instructions for the agent to process external data sources such as video transcripts and metadata via
/api/agent-transcript.jsonand/api/agent-context.json. This creates a surface for indirect prompt injection where malicious content within a recording's transcript could influence agent behavior.\n - Ingestion points: Untrusted data from recording transcripts and metadata enters the agent's context through specific API endpoints described in
SKILL.md.\n - Boundary markers: The skill instructions do not explicitly mandate the use of boundary markers or delimiters (e.g., XML tags or clear separators) to isolate external content from the agent's primary instructions.\n
- Capability inventory: The agent is empowered to read, summarize, and extract information (like frames and segments) from these recordings.\n
- Sanitization: The skill implements defensive measures including bcrypt for password hashing and the use of short-lived tokens to avoid exposing sensitive data in logs or downstream prompts.
Audit Metadata