magic-hour-campaign-kit
Pass
Audited by Gen Agent Trust Hub on Nov 5, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes user-supplied strings, such as headlines and Call-To-Action (CTA) text, to be rendered into generated media assets.
- Ingestion points: User-provided text strings for campaign assets described in SKILL.md and references/finishing.md.
- Boundary markers: Not explicitly defined for LLM prompt interpolation, but the skill provides strict technical boundaries for media assembly.
- Capability inventory: Calls to image/video generation APIs and local media processing tools (FFmpeg).
- Sanitization: The skill contains specific instructions to use FFmpeg's
drawtextfeature with local text files instead of shell-spliced strings, which is a high-quality mitigation against command injection via user data. - [EXTERNAL_DOWNLOADS]: The skill references the vendor's official documentation, API specifications, and example repositories.
- Fetches the OpenAPI specification from the official vendor domain (docs.magichour.ai).
- References user guides and examples hosted on the vendor's official GitHub repository (github.com/magichourhq).
- [COMMAND_EXECUTION]: The skill describes the use of FFmpeg for media assembly and annotation.
- The instructions include a specific security warning to never splice arbitrary copy into shell commands or filter expressions, providing a safe recipe for media generation.
Audit Metadata