Skills
Navigate
skills/leonvanzyl/skills/create-youtube-thumbnails/Gen Agent Trust Hub

create-youtube-thumbnails

Pass

Audited by Gen Agent Trust Hub on Oct 5, 2026

Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
  • [INDIRECT_PROMPT_INJECTION]: The skill processes external data, including YouTube transcripts and titles via the VidIQ MCP server, and competitor thumbnail research. This content is interpolated into prompts for image generation.
  • Ingestion points: YouTube transcripts and metadata are retrieved in references/research.md and used in scripts/gen.py via jobs.json.
  • Boundary markers: scripts/gen.py utilizes a WRAP template that provides explicit instructions to the downstream image generation tool to only perform image tasks and ignore any embedded commands or queries.
  • Capability inventory: The skill can execute the codex CLI tool (scripts/gen.py) and perform various image and file manipulations (scripts/dna.py, scripts/qa.py, scripts/stamp.py, scripts/report.py).
  • Sanitization: The skill relies on a strict instruction wrapper to constrain the behavior of the image generation tool when processing untrusted input summaries.
  • [COMMAND_EXECUTION]: scripts/gen.py invokes the codex command-line interface using subprocess.run to generate images.
  • Evidence: The script constructs a command to call codex exec with various parameters and executes it. On Windows platforms, this is performed with shell=True.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 5, 2026, 12:00 PM