magic-hour-ugc-ad-video
Pass
Audited by Gen Agent Trust Hub on Nov 3, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted external data, including product pages, customer-supplied facts, and reviews (SKILL.md). This creates a surface for indirect prompt injection where instructions embedded in those sources could attempt to influence the agent's behavior.
- Ingestion points: The agent is instructed to read supplied product pages, facts, and inspect source images to ground the ad brief.
- Boundary markers: The skill provides instructions to "Distinguish seller assertions from demonstrated facts" and warns to "never put invented experience, endorsement or results in a synthetic person's mouth."
- Capability inventory: The skill possesses capabilities to perform network API calls to the vendor's services (mcp.magichour.ai), upload files, and generate video/audio assets.
- Sanitization: The instructions mandate verifying all speech, names, numbers, and pronunciation against original facts before finalization.
- [EXTERNAL_DOWNLOADS]: The skill fetches an OpenAPI schema from
https://docs.magichour.ai/api-reference/openapi.jsonand utilizes an MCP server athttps://mcp.magichour.ai/to determine tool availability and execution parameters. These are vendor-owned resources hosted on the author's infrastructure. Additionally, the skill includes a reference to an external repository on GitHub (vargHQ/skills) for licensing and attribution purposes.
Audit Metadata