text-motion-reels
Pass
Audited by Gen Agent Trust Hub on Aug 13, 2026
Risk Level: SAFEPROMPT_INJECTIONCOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from external platforms (Reddit, Google Trends) via
scripts/trend-hunt.mjsto influence the generation of video hooks and scripts. - Ingestion points: Data is pulled from external subreddits and Google Trends APIs into the agent's context during the brainstorming phase (Step 0).
- Boundary markers: The instructions do not specify any delimiters or safety markers to prevent the agent from following malicious instructions potentially embedded in the fetched trending data.
- Capability inventory: The skill has access to local file system operations (read/write) and shell command execution (
node). - Sanitization: There is no evidence in the provided scripts of sanitization or filtering of external inputs before they are used in content generation prompts.
- [COMMAND_EXECUTION]: The skill requires the agent to execute multiple local scripts to fulfill its purpose, including
scripts/trend-hunt.mjsfor research,render/render-frames.mjsfor video production, andscripts/audit-reel.mjsfor quality control. - [EXTERNAL_DOWNLOADS]: The skill incorporates the GSAP animation library from the jsDelivr CDN (
https://cdn.jsdelivr.net/npm/gsap@3/dist/gsap.min.js). This is an industry-standard service for hosting open-source libraries.
Audit Metadata