creativeclaw-product-photoshoot
Pass
Audited by Gen Agent Trust Hub on Sep 6, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted external data such as product references and logos via the
search_assetstool and manual uploads. This creates a surface where instructions hidden in assets could potentially influence the agent. This ingestion is necessary for the skill's primary task of image consistency.\n - Ingestion points: Asset search and manual upload workflows in
SKILL.md.\n - Boundary markers: No specific delimiters are defined to separate asset data from system instructions.\n
- Capability inventory: The skill integrates with tools for asset management, theme retrieval, and image generation using multiple models.\n
- Sanitization: No explicit sanitization or validation of asset content is described.\n- [EXTERNAL_DOWNLOADS]: The skill connects to a vendor-owned MCP tool at
https://app.creativeclaw.co/mcp/chatgptto manage media and feedback. This is a standard functional integration for the developer's infrastructure.
Audit Metadata