remix-ad

Pass

Audited by Gen Agent Trust Hub on Jul 20, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: Fetches ad sample payloads from the Goose Ads library API (app.gooseworks.ai). This operation is a core function used to retrieve the structured remix payload, including scripts, shot lists, and asset references from the vendor's infrastructure.
  • [COMMAND_EXECUTION]: Executes local Python scripts (scripts/fetch_sample.py and scripts/build_remix_plan.py) to manage data retrieval and plan generation. These scripts are contained within the skill and use standard libraries.
  • [PROMPT_INJECTION]: The skill ingests ad metadata and scripts from an external API, which represents an indirect prompt injection surface. The workflow mitigates this risk by explicitly instructing the agent to use the fetched data as a reference for 'format and beat structure' while performing a complete rewrite for the target brand.
  • Ingestion points: Ad metadata and scripts fetched via fetch_sample.py from the library API.
  • Boundary markers: Instructions specify using source content as a structural reference rather than literal instruction.
  • Capability inventory: Local script execution and routing to other production templates.
  • Sanitization: The original content is filtered through the agent's rewrite process for the new brand context.
  • [CREDENTIALS_UNSAFE]: Utilizes an environment variable GOOSEWORKS_API_TOKEN for API authentication. The skill follows best practices by instructing the user to store this in a .env file instead of hardcoding credentials.
Audit Metadata
Risk Level
SAFE
Analyzed
Jul 20, 2026, 06:24 PM
Security Audit — agent-trust-hub — remix-ad