ad-compliance-review
Pass
Audited by Gen Agent Trust Hub on Oct 30, 2026
Risk Level: SAFECOMMAND_EXECUTIONDATA_EXFILTRATIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill uses the
cinefoundryCLI tool to perform deterministic compliance scans on advertising copy files stored in project-specific directories (projects/<id>/script/copy.txt). - [DATA_EXFILTRATION]: The skill optionally transmits advertising copy to an external cloud-based model ("Jev") for scoring when the
TYPESAFE_API_KEYenvironment variable is configured. The skill documentation explicitly discloses that this data leaves the local environment for cloud processing. - [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted advertising copy which presents a surface for indirect prompt injection.
- Ingestion points: Advertising strings (VO, subtitles, and titles) are read from
projects/<id>/script/copy.txt. - Boundary markers: The skill processes strings line-by-line without explicit delimiters or "ignore embedded instructions" warnings for the ingested content.
- Capability inventory: The skill uses the
cinefoundryCLI for scanning and has the ability to generate revised JSON output for the harness to merge into project scripts. - Sanitization: No explicit sanitization or validation of the input strings is described prior to the review process.
Audit Metadata