magic-hour-body-swap

Pass

Audited by Gen Agent Trust Hub on Sep 11, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
  • [SAFE]: The skill instructions and metadata align with the stated purpose of providing an interface for the Magic Hour Body Swap service. No prompt injection, obfuscation, or persistence mechanisms were found.
  • [EXTERNAL_DOWNLOADS]: The skill references documentation, setup guides, and examples hosted on official vendor domains and repositories, including docs.magichour.ai and github.com/magichourhq. These are recognized as trusted vendor resources.
  • [INDIRECT_PROMPT_INJECTION]: The skill processes user-provided images which constitutes an untrusted data ingestion surface.
  • Ingestion points: User-supplied image files via assets.person_file_path and assets.scene_file_path (SKILL.md).
  • Boundary markers: Explicit instructions are provided to inspect images for compatibility and identity preservation before processing, though no technical delimiters for image content are present.
  • Capability inventory: The skill uses video_assets_generate_presigned_url to upload assets and body_swap_create_image to perform API-based image generation.
  • Sanitization: The skill relies on visual inspection of the output contact sheet to verify subject scale, shadow direction, and identity, rather than automated sanitization of the input data.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 11, 2026, 08:30 AM
Security Audit — agent-trust-hub — magic-hour-body-swap