publish-to-social
Pass
Audited by Gen Agent Trust Hub on Oct 9, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes external data including video URLs and captions which are transmitted to the agent-media.ai API.
- Ingestion points: The
video_urlandcaptionparameters in thesocial_publishtool and REST endpoints. - Boundary markers: No specific delimiters or instructions to ignore embedded commands are defined for the input fields.
- Capability inventory: The skill has the capability to perform network POST requests to the vendor's API.
- Sanitization: The instructions do not specify input validation or sanitization mechanisms for the user-provided captions or URLs.
- [SAFE]: The skill facilitates standard social media integration using vendor-owned infrastructure (agent-media.ai) and well-known services (Cloudflare R2). No malicious patterns such as credential harvesting, remote code execution, or unauthorized data exfiltration were identified.
Audit Metadata