arcads-broll

Pass

Audited by Gen Agent Trust Hub on Sep 20, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSDATA_EXFILTRATIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill refers the user to a companion repository (github.com/krusemediallc/arcads-claude-code) to manage API integration and prompting logic.
  • [DATA_EXFILTRATION]: The skill facilitates data transmission to the Arcads external API (external-api.arcads.ai) to generate video assets. It utilizes an API key (ARCADS_API_KEY) for authentication and advises storing it in a .env file, which is a standard security practice for local secret management.
  • [INDIRECT_PROMPT_INJECTION]: The skill presents an attack surface for indirect prompt injection as it processes user-provided descriptions for video generation. 1. Ingestion points: User-supplied text prompts for media generation. 2. Boundary markers: No explicit delimitation or instructions to prevent the model from following commands embedded in the B-roll descriptions are provided. 3. Capability inventory: The skill performs network POST requests to an external API. 4. Sanitization: There is no description of content validation or sanitization before the user's input is passed to the generation models.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 20, 2026, 08:46 AM