upload-ad-sample
Pass
Audited by Gen Agent Trust Hub on Jul 3, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSDATA_EXFILTRATIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill uses
curlto perform API requests and file uploads to S3. It also utilizesffmpegandffprobefor media tasks such as extracting thumbnails and calculating video duration.\n- [EXTERNAL_DOWNLOADS]: Interacts withapp.gooseworks.ai(the author's official platform) to register samples and retrieve upload credentials.\n- [DATA_EXFILTRATION]: Reads local media and project-related JSON metadata to transmit them to the remote API. This is the intended and documented primary behavior of the skill for publishing ad assets.\n- [PROMPT_INJECTION]: The skill processes project data files which serves as a potential surface for indirect prompt injection.\n - Ingestion points: Files such as
thread_jsonand project production JSONs are read and parsed.\n - Boundary markers: None are explicitly defined in the instructions for the data being processed.\n
- Capability inventory: The agent has read access to the local filesystem and network access via
curl.\n - Sanitization: No specific filtering or escaping is described for the content of the processed files.
Audit Metadata