static-ad
Pass
Audited by Gen Agent Trust Hub on Sep 9, 2026
Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTIONINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill relies on the execution of shell commands via the
codex execandhiggsfieldCLI tools to generate and manipulate images. It also references a local execution script attools/fal_edit.pyfor image editing tasks. - [PROMPT_INJECTION]: Instructions in Part 2 suggest using CLI tools specifically to circumvent content filters present in web applications (e.g., blocking currency notes as "protected content"), which constitutes a safety guideline bypass.
- [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data (briefs and copy) from the
ad-strategyagent. This data is interpolated into prompts used for image generation and command execution. - Ingestion points: Reads campaign briefs and copy from the
ad-strategyagent. - Boundary markers: Utilizes "Shared Constraints" blocks and explicit hard-negatives to attempt to restrict the image model's behavior.
- Capability inventory: Includes shell command execution (
codex,higgsfield), file system writing (workspace-write), and local script execution. - Sanitization: Implements a vision-based gate through the
static-qaagent to verify outputs before human review, although this does not prevent injection at the input stage. - [DYNAMIC_EXECUTION]: The skill describes the programmatic generation of graphical elements (such as security marks and stars) using code libraries like Pillow or SVG rendering to overcome limitations in generative models.
Audit Metadata