arcads-broll
Pass
Audited by Gen Agent Trust Hub on Sep 20, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSDATA_EXFILTRATIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill refers the user to a companion repository (
github.com/krusemediallc/arcads-claude-code) to manage API integration and prompting logic. - [DATA_EXFILTRATION]: The skill facilitates data transmission to the Arcads external API (
external-api.arcads.ai) to generate video assets. It utilizes an API key (ARCADS_API_KEY) for authentication and advises storing it in a.envfile, which is a standard security practice for local secret management. - [INDIRECT_PROMPT_INJECTION]: The skill presents an attack surface for indirect prompt injection as it processes user-provided descriptions for video generation. 1. Ingestion points: User-supplied text prompts for media generation. 2. Boundary markers: No explicit delimitation or instructions to prevent the model from following commands embedded in the B-roll descriptions are provided. 3. Capability inventory: The skill performs network POST requests to an external API. 4. Sanitization: There is no description of content validation or sanitization before the user's input is passed to the generation models.
Audit Metadata