creative-claw-onboard
Pass
Audited by Gen Agent Trust Hub on Apr 15, 2026
Risk Level: SAFEPROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [PROMPT_INJECTION]: The skill instructs the agent to ingest and process potentially untrusted external content, which presents a surface for indirect prompt injection.
- Ingestion points: Data enters the context from external websites during brand theme extraction (via the
/create-brand-themehand-off) and through user-provided prompts or HTML snippets for media generation. - Capability inventory: The skill has access to powerful tools for image, video, and speech generation, as well as an HTML rendering engine using headless Chromium.
- Boundary markers: No specific delimiters or instructions to ignore embedded commands within processed data are provided in the skill instructions.
- Sanitization: The skill does not define validation or sanitization steps for content retrieved from external URLs before it is used to generate branded assets or rendered as HTML.
- [EXTERNAL_DOWNLOADS]: The skill provides references to the vendor's official documentation and pricing at
https://creativeclaw.co/pricing.
Audit Metadata