creativeclaw-setup
Pass
Audited by Gen Agent Trust Hub on Oct 14, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill possesses an attack surface for indirect prompt injection as it ingests untrusted data from user-provided websites, brand kits, and office documents (PDF, DOCX, XLSX). This is an inherent part of the skill's media generation purpose (e.g., extracting brand colors or thematic references). The skill includes instructions to treat this external data as visual or thematic anchors rather than authoritative instructions, lowering the risk of the agent obeying embedded commands.
- [EXTERNAL_DOWNLOADS]: The skill connects to the vendor's official MCP server hosted at
app.creativeclaw.co. This connection is required for tool invocation and is a standard operational dependency on the vendor's own infrastructure.
Audit Metadata