remix-ad
Pass
Audited by Gen Agent Trust Hub on Jul 20, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: Fetches ad sample payloads from the Goose Ads library API (app.gooseworks.ai). This operation is a core function used to retrieve the structured remix payload, including scripts, shot lists, and asset references from the vendor's infrastructure.
- [COMMAND_EXECUTION]: Executes local Python scripts (
scripts/fetch_sample.pyandscripts/build_remix_plan.py) to manage data retrieval and plan generation. These scripts are contained within the skill and use standard libraries. - [PROMPT_INJECTION]: The skill ingests ad metadata and scripts from an external API, which represents an indirect prompt injection surface. The workflow mitigates this risk by explicitly instructing the agent to use the fetched data as a reference for 'format and beat structure' while performing a complete rewrite for the target brand.
- Ingestion points: Ad metadata and scripts fetched via fetch_sample.py from the library API.
- Boundary markers: Instructions specify using source content as a structural reference rather than literal instruction.
- Capability inventory: Local script execution and routing to other production templates.
- Sanitization: The original content is filtered through the agent's rewrite process for the new brand context.
- [CREDENTIALS_UNSAFE]: Utilizes an environment variable
GOOSEWORKS_API_TOKENfor API authentication. The skill follows best practices by instructing the user to store this in a.envfile instead of hardcoding credentials.
Audit Metadata