longform-publish-folder
Pass
Audited by Gen Agent Trust Hub on Apr 8, 2026
Risk Level: SAFE
Full Analysis
- [COMMAND_EXECUTION]: The skill documentation provides command-line examples for users to manually trigger the Node.js script or schedule it via cron.
- [EXTERNAL_DOWNLOADS]: The script communicates with the Late API (zernio.com) for media uploads and publishing, and the Google Gemini API for metadata generation.
- [DATA_EXFILTRATION]: The script reads the project's 'SOCIALS.md' file to retrieve the Profile ID and Late Account ID necessary for authentication with the publishing service.
- [PROMPT_INJECTION]: The skill possesses an indirect prompt injection surface as video filenames and user-provided topic strings are interpolated into the prompt used for AI metadata generation.
- Ingestion points: Video filenames in the watch folder and the '--topic' argument in 'scripts/longform-publish-folder.js'.
- Boundary markers: Absent. Input data is placed directly into the natural language prompt.
- Capability inventory: File system access for reading videos and writing sidecar status files, along with network access for uploading content.
- Sanitization: Filenames undergo basic character replacement of underscores and hyphens, but no formal sanitization or escaping is applied to prevent instruction overrides in the prompt context.
Audit Metadata