Skills
Navigate
skills/magichourhq/skills/magic-hour-face-swap/Gen Agent Trust Hub

magic-hour-face-swap

Pass

Audited by Gen Agent Trust Hub on Sep 11, 2026

Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted user-provided media files and has the capability to interact with network endpoints.
  • Ingestion points: Video and image file paths provided to tools like face_swap_create_video and face_swap_photo_create_image as documented in SKILL.md.
  • Boundary markers: The instructions lack specific delimiters or warnings to ignore potential instructions embedded within media metadata or content.
  • Capability inventory: The skill uses MCP tools for media generation and performs network uploads via presigned URLs to magichour.ai infrastructure.
  • Sanitization: There is no evidence of sanitization for non-media data that might be embedded in the source files.
  • [EXTERNAL_DOWNLOADS]: The skill references several external resources, including the vendor's MCP server at https://mcp.magichour.ai/, API documentation at docs.magichour.ai, and example projects on GitHub under the magichourhq organization. These are standard vendor resources for service integration.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 11, 2026, 08:30 AM
Security Audit — agent-trust-hub — magic-hour-face-swap