upload-post
Pass
Audited by Gen Agent Trust Hub on Apr 8, 2026
Risk Level: SAFEPROMPT_INJECTIONEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [PROMPT_INJECTION]: The skill processes untrusted user-supplied content such as post titles, descriptions, and comments which are sent to external social media platforms. It lacks instructions for sanitization or boundary markers, creating a surface for indirect prompt injection. \n
- Ingestion points: User-provided text for 'title', 'description', and 'first_comment' fields in SKILL.md. \n
- Boundary markers: Absent in instructions for content interpolation. \n
- Capability inventory: Network transmission of data to external platforms via the vendor API. \n
- Sanitization: No sanitization or validation logic is specified. \n- [EXTERNAL_DOWNLOADS]: The skill communicates with the vendor's API endpoints at api.upload-post.com and references documentation at docs.upload-post.com. This is expected behavior for the skill's primary purpose. \n- [COMMAND_EXECUTION]: Provides instructions for using a remote FFmpeg processing endpoint where the agent constructs command strings. This execution is performed on the vendor's server infrastructure.
Audit Metadata