Skills
Navigate
skills/coleschaffer/dtc-copywriting-skills/media-buying-brief/Gen Agent Trust Hub

media-buying-brief

Fail

Audited by Gen Agent Trust Hub on Aug 11, 2026

Risk Level: HIGHCOMMAND_EXECUTIONDATA_EXFILTRATIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill preamble executes shell commands to determine the installation path and run local scripts (rmbc-update-check and rmbc-analytics) from a dynamically resolved directory path.
  • [COMMAND_EXECUTION]: A significant vulnerability exists in the workspace configuration step, where the agent executes /bin/rmbc-workspace active "<user's answer>". The use of unvalidated freeform user input in a shell command allows for command injection attacks.
  • [DATA_EXFILTRATION]: The skill implements a telemetry system via the rmbc-analytics script to log usage metadata. This mechanism is designed to send information about skill usage and product tiers to the vendor's infrastructure.
  • [EXTERNAL_DOWNLOADS]: The skill uses the shell open command to navigate to a YouTube URL (https://www.youtube.com/watch?v=zI8tNfefH1M).
  • [PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection.
  • Ingestion points: product_description, target_audience, and existing_data fields in SKILL.md.
  • Boundary markers: Absent; user input is interpolated directly into instructions.
  • Capability inventory: Shell command execution via /bin/rmbc-workspace and preamble scripts.
  • Sanitization: No escaping or validation is performed on the user-provided inputs.
Recommendations
  • AI detected serious security threats
Audit Metadata
Risk Level
HIGH
Analyzed
Aug 11, 2026, 01:37 PM
Security Audit — agent-trust-hub — media-buying-brief