reference-media-analysis
Pass
Audited by Gen Agent Trust Hub on Sep 20, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [SAFE]: The skill provides rigorous safety-first instructions for handling untrusted reference materials. It mandates the protection of intellectual property, likeness, and private data.
- [EXTERNAL_DOWNLOADS]: The skill references technical specifications and guidelines from recognized trusted entities, including C2PA (spec.c2pa.org), IPTC (iptc.org), the US Copyright Office (copyright.gov), the FTC (ftc.gov), NIST (nist.gov), and the European Commission (europa.eu). These references are informational and aid in verifying the provenance and rights status of media.
- [INDIRECT_PROMPT_INJECTION]: The skill's core function involves processing untrusted media, which presents a surface for indirect prompt injection. However, the instructions mitigate this through a mandatory risk ledger, strict abstraction rules (governing rule: extract function, not identity), and similarity QA triggers to prevent the agent from mimicking unauthorized content.
- Ingestion points: External media files, URLs, and client uploads analyzed via the clearance ledger in SKILL.md.
- Boundary markers: Explicit separation of documented facts from production inferences, along with originality constraints in prompt handoffs.
- Capability inventory: No executable tools, scripts, or network capabilities are defined or requested in the frontmatter.
- Sanitization: The skill requires translating analysis into provider-independent prompts that use negative constraints and must-change instructions to ensure the distinctness of the final output.
Audit Metadata