reel-cover-generator
Pass
Audited by Gen Agent Trust Hub on Oct 14, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes user-provided video scripts and interpolates derived content (titles, subtitles, and theme summaries) into a final image generation prompt. A malicious script could attempt to influence the generated image by including hidden instructions within the script text.
- Ingestion points: User-provided video scripts are ingested in Step 1 of the workflow defined in
SKILL.md. - Boundary markers: The skill uses a structured prompt template in Step 4, but there are no explicit boundary markers or instructions for the agent to ignore embedded commands within the input script.
- Capability inventory: The skill utilizes the
gemini:generate_imagetool to create visual content. - Sanitization: There is no automated sanitization of the input script. However, the skill implements a mandatory review step (Step 5) where the fully constructed prompt is presented to the user for approval before the image generation tool is invoked.
- [EXTERNAL_DOWNLOADS]: The documentation instructs users to download and configure external assets and tools to enable full functionality.
- References
font.thmanyah.comfor downloading brand-specific typography files. - Recommends the installation of the
@houtini/gemini-mcpNode.js package to facilitate Gemini API integration within the Claude environment.
Audit Metadata