reel-cover-generator
Pass
Audited by Gen Agent Trust Hub on May 12, 2026
Risk Level: SAFEPROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [SAFE]: The skill requests absolute file paths for local image assets and output destinations. This is a functional requirement for the Gemini MCP tool used by the skill to access and save files on the host system. Users are guided on how to provide these paths safely.
- [PROMPT_INJECTION]: The skill ingests untrusted text from user scripts to generate titles and subtitles for an image generation prompt. This creates a surface for indirect prompt injection. However, the implementation includes a mandatory review step (Step 5) where the full prompt is shown to the user for approval before any generation tools are invoked, providing effective mitigation.
- [EXTERNAL_DOWNLOADS]: The documentation directs users to install external dependencies, specifically the
@houtini/gemini-mcppackage and the skill itself vianpx. These are standard installation procedures for the skill's intended architecture and use of the Model Context Protocol (MCP).
Audit Metadata