ai-social-media-content
Pass
Audited by Gen Agent Trust Hub on Apr 29, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill uses the
infshCLI to execute tasks such as image and video generation. Examples include batch processing and piping results to local files, which are standard for the CLI's functionality. - [EXTERNAL_DOWNLOADS]: The documentation references an installation script for the
infshCLI on a GitHub repository (inference-sh/skills). This is a vendor-controlled resource necessary for the skill's operation. - [PROMPT_INJECTION]: The skill contains a pattern for indirect prompt injection where user-provided input is used to construct prompts for remote AI models.
- Ingestion points: The variables
$CONCEPTandTOPICSin the bash examples take user input from the environment or command line. - Boundary markers: No specific delimiters or safety instructions are included to prevent user input from overriding the intended prompt logic.
- Capability inventory: The skill uses
Bashto invoke theinfshCLI, which interacts with remote APIs and can write data to the local file system. - Sanitization: There is no evidence of input validation or escaping for the user-provided content before it is embedded in the JSON payloads.
Audit Metadata