layer-ua-creatives
Pass
Audited by Gen Agent Trust Hub on Oct 29, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes external data including user-provided gameplay captures, reference images, and prompt hooks. This creates a potential surface for indirect prompt injection where instructions could be hidden in visual or text inputs to manipulate tool outputs. However, this is an inherent part of the creative generation workflow and is managed by the platform's standard generation tools.
- Ingestion points: Key art (
reference_image), gameplay captures uploaded viarequest_file_upload_url, and user-defined hook descriptions. - Boundary markers: Not specified in the instructional text.
- Capability inventory: Image editing, text-to-image generation, image-to-video animation, text rendering, and video timeline assembly.
- Sanitization: Relies on underlying model guardrails and vendor tool implementations.
- [EXTERNAL_DOWNLOADS]: The skill instructions include a command for users to install missing sibling skills from the
layerai/skillsrepository usingnpx. These references target the vendor's own official ecosystem and do not constitute an unauthorized or suspicious external download.
Audit Metadata