meta-upload
Pass
Audited by Gen Agent Trust Hub on Oct 24, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill facilitates the execution of the
sauCLI tool for social media management. Example scripts are provided in Python, Bash, and PowerShell to demonstrate integration. - Evidence: Command patterns like
sau facebook-page upload-videoare used throughoutSKILL.mdand thescripts/examples/directory. - [INDIRECT_PROMPT_INJECTION]: The skill possesses a standard attack surface for indirect injection as it processes untrusted user-supplied strings (titles, descriptions, and Page names) as arguments for CLI commands.
- Ingestion points: Untrusted data enters via the
--title,--desc,--note, and--pageparameters inSKILL.mdand example scripts. - Boundary markers: No specific delimiters or safety warnings are provided in the skill text to differentiate between instructions and data.
- Capability inventory: The skill allows for the creation, scheduling, and deletion of content on Facebook Pages using local CLI credentials.
- Sanitization: The skill relies on the integrity of the underlying
sauCLI tool to sanitize input before execution; no additional validation is performed at the prompt level.
Audit Metadata