short-form-research

Pass

Audited by Gen Agent Trust Hub on Oct 17, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill uses WebSearch and WebFetch to retrieve content from social media platforms such as TikTok, Instagram, and YouTube, as well as official documentation for algorithm research. These sources are well-known services and essential for the skill's research purpose.
  • [COMMAND_EXECUTION]: The orchestrator executes scripts/bootstrap-experience.ts to initialize local directories for persistent state. The script implements security best practices by validating directory paths and refusing to interact with symbolic links to prevent directory traversal or symlink attacks.
  • [INDIRECT_PROMPT_INJECTION]: The skill has an inherent surface for indirect prompt injection as it processes untrusted user-generated content (captions, metadata) from external social media platforms.
  • Ingestion points: agents/platform-scout-agent.md fetches video data from external URLs.
  • Boundary markers: Absent. The skill does not explicitly use delimiters or specialized instructions to isolate untrusted web content from its internal logic.
  • Capability inventory: The skill utilizes Write to save artifacts and Bash for infrastructure setup.
  • Sanitization: No specific sanitization or filtering of external content is performed prior to processing by the extractor agents.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 17, 2026, 10:34 PM