mira-ads
Pass
Audited by Gen Agent Trust Hub on Nov 4, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted user data (headlines, offer text, and marketing brief messages) and incorporates it into generation prompts.
- Ingestion points: User-supplied 'headline', 'offer text', and content from the marketing brief's 'message' and 'offer' fields.
- Boundary markers: The instructions emphasize literal reproduction ('character for character', 'exactly in those words'), which provides clear intent but lacks technical delimiters or boundary markers in the final prompt assembly to prevent user-supplied text from potentially containing instructions that influence the generation model's behavior.
- Capability inventory: The skill utilizes a wide array of video and image generation models (including Runway, Kling, and GPT-Image) and interfaces with marketing automation tools and social media publishing flows.
- Sanitization: No explicit sanitization or validation of the user-provided text is described beyond the instruction to reproduce it verbatim.
- [SAFE]: The skill references established model names and refers to internal platform documentation and tools (e.g., Mira AI Marketing Studio) which are consistent with the vendor's declared infrastructure.
Audit Metadata