write-video-ad-script
Pass
Audited by Gen Agent Trust Hub on Oct 27, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONDATA_EXFILTRATIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The
media_proxy.pyandcritique_scripts.pyscripts facilitate communication with external AI and media generation APIs, including FAL and ElevenLabs. These requests are routed through GooseWorks-managed proxy endpoints (e.g.,api.gooseworks-ai.comdomains) to handle authentication and credit management. The skill also utilizesurllib.request.urlretrieveto download generated assets locally. - [COMMAND_EXECUTION]: The skill uses
subprocess.runinverify_handoff.pyand several test files to execute internal Python components likelint_scripts.pyandprepare_angle_context.py. This is part of the skill's self-validation and linting workflow to ensure generated scripts meet specific quality and technical criteria. - [DATA_EXFILTRATION]: The
media_proxy.pyscript reads authentication data from the configuration file~/.gooseworks/credentials.json. This information, along with campaign context and ad script content, is transmitted to vendor-authorized proxy endpoints for the purpose of generating media and critiques. This behavior is consistent with the skill's primary function and relies on the developer's own infrastructure. - [INDIRECT_PROMPT_INJECTION]: The
critique_scripts.pyscript processes ad candidates, customer quotes, and creative briefs to generate prompts for an external LLM critic. While this creates a surface for indirect prompt injection via the ingested content, the skill uses structured JSON formatting and explicit role definitions for the LLM to maintain process integrity.
Audit Metadata