product-launch-video
Warn
Audited by Gen Agent Trust Hub on Sep 19, 2026
Risk Level: MEDIUMEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill recommends using
npx -y shadcn@latest addto download components fromhttps://remocn.dev/r/<component>.json. This allows the execution of remote configuration files to populate the local project directory. - [COMMAND_EXECUTION]: Workflow instructions involve running shell commands for package installation and project validation, specifically
npxandnode scripts/check-project.mjs. - [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted content from external product URLs to extract copy and UI elements. This creates a surface where a malicious website could embed instructions to manipulate the generated script or storyboard.
- Ingestion points:
SKILL.md(Workflow Step 1) instructs the agent to inspect supplied URLs. - Boundary markers: Not present. The agent is not instructed to isolate or ignore instructions within the source material.
- Capability inventory: File system writing and script execution.
- Sanitization: None described.
Audit Metadata