make-a-social-reel
Pass
Audited by Gen Agent Trust Hub on Nov 11, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill fetches external video content from user-provided public HTTPS URLs via the
import_mediatool. This is a standard operation required for its primary function of reel creation. - [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted external data by extracting transcripts and visual context from imported media to inform the composition logic. This creates a potential surface for indirect prompt injection where malicious content in a video transcript could influence agent behavior.
- Ingestion points: Footage URLs processed via
import_mediatool. - Capability inventory: Video composition tools including
new_composition,apply_composition, andcreate_render. - Boundary markers: The instructions do not define specific delimiters to isolate external transcript data from the agent's logic.
- Sanitization: The skill does not implement explicit validation or sanitization of the extracted transcript text before using it to derive composition shots.
Audit Metadata