skills/gooseworks-ai/gooseworks-ads-skills/create-product-images-higgsfield-product-photoshoot/Gen Agent Trust Hub
create-product-images-higgsfield-product-photoshoot
Pass
Audited by Gen Agent Trust Hub on Aug 19, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes user-supplied briefs and source assets which are interpolated into prompts for external generative AI models.\n
- Ingestion points: User brief and source asset paths defined in
SKILL.md.\n - Boundary markers: No explicit delimiters or instructions to ignore embedded commands are documented for the prompt construction.\n
- Capability inventory: The skill uses file writing, network calls to AI APIs, and shell-based media processing via internal scripts.\n
- Sanitization: Includes logic for scrubbing NSFW vocabulary from prompts as described in
references/nsfw_routing.md.\n- [DYNAMIC_EXECUTION]: The skill usesscripts/render_hyperframe.pyto execute HTML and GSAP (JavaScript) code via Playwright for rendering pixel-perfect graphics.\n - The logic involves frame-by-frame rendering driven by
document.timeline.currentTime.\n- [COMMAND_EXECUTION]: The skill documentation references several internal Python scripts (scripts/composite.py,scripts/make_subtitles.py,scripts/qc_review.py) that perform shell-level operations usingffmpegandplaywrightfor video assembly and quality control.\n- [EXTERNAL_DOWNLOADS]: The skill documentation suggests environment setup steps includingpip install playwright pillowand system package installations (brew install ffmpeg-fullorapt install ffmpeg). It also makes network requests to various AI service providers (fal.ai, ElevenLabs, Veed, Higgsfield). These are documented as necessary dependencies for the media generation task.
Audit Metadata