ugc-campaign-management
Pass
Audited by Gen Agent Trust Hub on Sep 16, 2026
Risk Level: SAFENO_CODE
Full Analysis
- [SAFE]: The skill provides documentation and structural guidance for UGC workflows (collection, rights management, moderation). It contains no executable scripts or commands beyond illustrative code snippets and API definitions.
- [EXTERNAL_DOWNLOADS]: The skill references standard APIs from trusted platforms (Instagram/Facebook Graph API) and mentions third-party Shopify apps (Yotpo, Okendo, Loox, TINT) in an educational context. None of these involve the automated execution of untrusted code.
- [PROMPT_INJECTION]: No attempts to override agent behavior or bypass safety guidelines were found in the SKILL.md or supporting files.
- [DATA_EXFILTRATION]: While the skill discusses collecting user content, these are standard e-commerce features. No sensitive environment variables (keys, secrets) or private data access patterns are present. Instructions correctly suggest using
.envfor secrets. - [INDIRECT_PROMPT_INJECTION]: The skill ingests UGC which is technically untrusted data; however, it lacks execution capabilities that would make it vulnerable to indirect injection attacks. The presence of moderation guidelines reduces this risk further.
Audit Metadata