reels-scripting
Warn
Audited by Gen Agent Trust Hub on Sep 16, 2026
Risk Level: MEDIUMPROMPT_INJECTIONCOMMAND_EXECUTIONDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTIONDYNAMIC_CONTEXT_INJECTION
Full Analysis
- [PROMPT_INJECTION]: The skill instructions use authoritative override language such as 'CRITICAL: Auto-start on load', 'Non-negotiable', and 'Never skip' to bypass standard agent summarization and enforce specific behavioral constraints.
- [DYNAMIC_EXECUTION]: The skill is designed to programmatically write a JavaScript file ('analyse-reel.js') to the user's desktop and execute it using Node.js. This script handles API interactions, file system operations, and data processing at runtime.
- [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from Instagram Reel captions and Notion pages which is then used for script generation and video analysis. The skill lacks documented sanitization for this external data while possessing significant file-writing and network capabilities.
- [DYNAMIC_CONTEXT_INJECTION]: The instructions utilize the '! command' syntax for suggesting environment variable configuration, a pattern that involves direct shell interaction.
- [COMMAND_EXECUTION]: The skill requires and triggers the execution of local Node.js scripts and npm pipeline commands to perform its core scraping and analysis functions.
Audit Metadata