magic-hour-character-consistency
Pass
Audited by Gen Agent Trust Hub on Nov 5, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill references documentation, examples, and setup guides from the author's official GitHub repositories and domains (magichour.ai, magichourhq/skills, magichourhq/magic-hour-mcp). It also cites a character design reference from a partner organization (vargHQ) as permitted by the license. These external resources are used for configuration, API schemas, and instructional examples.
- [COMMAND_EXECUTION]: The instructions direct the agent to utilize a Model Context Protocol (MCP) server at a vendor-specified endpoint (mcp.magichour.ai) and specific API endpoints for tasks such as
generate_image,edit_image, andcreate_video_from_image. These are standard tool calls for the skill's intended purpose. - [INDIRECT_PROMPT_INJECTION]: The skill is designed to process user-provided character briefs and images. It includes specific mitigation instructions to "record visible facts; do not infer hidden details or a real person's identity" and to "exclude labels, neighboring characters and unrelated panels" when processing references, which helps maintain the integrity of the generated output against untrusted data.
Audit Metadata