youtube-thumbnail
Pass
Audited by Gen Agent Trust Hub on Sep 16, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill reads local project files such as brand-kit.md and about-me.md to personalize the thumbnail prompt. While this creates a surface for indirect prompt injection, it is the primary intended functionality of the skill and carries low risk as the output is a text-based prompt for the user to review.
- [SAFE]: No malicious code execution, network exfiltration, or obfuscation techniques were identified. The skill includes specific safeguards to prevent sensitive data, such as local file paths, from being included in the generated output.
Audit Metadata