magic-hour-body-swap
Pass
Audited by Gen Agent Trust Hub on Sep 11, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [SAFE]: The skill instructions and metadata align with the stated purpose of providing an interface for the Magic Hour Body Swap service. No prompt injection, obfuscation, or persistence mechanisms were found.
- [EXTERNAL_DOWNLOADS]: The skill references documentation, setup guides, and examples hosted on official vendor domains and repositories, including
docs.magichour.aiandgithub.com/magichourhq. These are recognized as trusted vendor resources. - [INDIRECT_PROMPT_INJECTION]: The skill processes user-provided images which constitutes an untrusted data ingestion surface.
- Ingestion points: User-supplied image files via
assets.person_file_pathandassets.scene_file_path(SKILL.md). - Boundary markers: Explicit instructions are provided to inspect images for compatibility and identity preservation before processing, though no technical delimiters for image content are present.
- Capability inventory: The skill uses
video_assets_generate_presigned_urlto upload assets andbody_swap_create_imageto perform API-based image generation. - Sanitization: The skill relies on visual inspection of the output contact sheet to verify subject scale, shadow direction, and identity, rather than automated sanitization of the input data.
Audit Metadata