fountain-onboarding
Warn
Audited by Gen Agent Trust Hub on Sep 22, 2026
Risk Level: MEDIUMCOMMAND_EXECUTIONDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTIONPERSISTENCEEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill instructs the agent to perform automated software installation if dependencies are missing.
- Evidence: Step 8 in
SKILL.mdlistsPython 3.11,yt-dlp,ffmpeg,OpenCV, andImageMagickas requirements and states: "If something is missing, attempt to install it yourself." - [DYNAMIC_EXECUTION]: The global guidelines allow for the creation and execution of temporary scripts to process API tasks.
- Evidence:
HOUSEKEEPING.mdunder 'Additional details' states: "You CAN write a throwaway script, e.g. to repeat one request over many items." - [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted external data during its brand research phase, creating an injection surface.
- Ingestion points: Researching the "look of the show" via artwork, websites, and existing clips (Step 9,
SKILL.md). - Boundary markers: None specified for this step.
- Capability inventory: File writes (preferences), tool execution (ffmpeg, yt-dlp, whisper.cpp), and API calls.
- Sanitization: Not explicitly mentioned for external research data.
- [PERSISTENCE]: The skill configures recurring tasks to maintain a daily workflow.
- Evidence: Step 10 in
SKILL.mdand the 'Automation' section inHOUSEKEEPING.mddescribe setting up a "daily growth" loop using thefountain-daily-growthskill. - [EXTERNAL_DOWNLOADS]: The skill fetches resources from external sources, including the vendor's own repositories and specialized model files.
- Evidence: Fetches plugins and configuration from the vendor's official GitHub repository (
github.com/fountain-fm/fountain-skills). - Evidence: Downloads a
whisper.cppmodel file (ggml-base.en.bin) to~/.cache/whisper(Step 8,SKILL.md).
Audit Metadata