magic-hour-thumbnails
Pass
Audited by Gen Agent Trust Hub on Nov 5, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill references external resources for documentation, API specifications, and tool connectivity, all hosted on domains owned by the author (magichourhq).
- Evidence: References to
https://mcp.magichour.ai/,https://docs.magichour.ai/api-reference/openapi.json, and themagichourhqGitHub organization inSKILL.mdandreferences/cover-design.md. - [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted external data (titles, transcripts, and outlines) to generate image prompts, which is a common attack surface for indirect prompt injection.
- Ingestion points: User-supplied video titles, transcripts, and outlines are read in
SKILL.mdto infer a visual hook. - Boundary markers: No specific delimiters or "ignore embedded instructions" warnings are defined for the ingested text.
- Capability inventory: The skill utilizes image generation and editing tools (
edit_image,generate_image) and file upload tools (get_upload_urls). - Sanitization: No explicit sanitization of input data is mentioned before it is used to influence the image generation process.
Audit Metadata