skills/hojiahao/cinefoundry/brand-kit/Gen Agent Trust Hub

brand-kit

Pass

Audited by Gen Agent Trust Hub on Oct 30, 2026

Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill instructs the agent to execute 'cinefoundry' commands and system utilities like 'fc-list' with user-supplied arguments such as brand IDs and brief text.
  • [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted brand briefs and configuration data that influence creative output and compliance checks. Ingestion points include the '--brief' flag and 'brand.json' fields, with 'palette[].name' explicitly interpolated into image prompts. No explicit boundary markers or delimiters are defined for these external inputs. The skill's capability inventory includes command execution and local file system access. Sanitization measures include 'forbidden words' filtering and an 'Advertising Law scan'.
  • [DATA_EXPOSURE]: The skill reads and writes brand-related assets, including logos, photos, and reports, within the local workspace folders.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 30, 2026, 11:41 PM