magic-hour-ugc-ad-video

Pass

Audited by Gen Agent Trust Hub on Nov 3, 2026

Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted external data, including product pages, customer-supplied facts, and reviews (SKILL.md). This creates a surface for indirect prompt injection where instructions embedded in those sources could attempt to influence the agent's behavior.
  • Ingestion points: The agent is instructed to read supplied product pages, facts, and inspect source images to ground the ad brief.
  • Boundary markers: The skill provides instructions to "Distinguish seller assertions from demonstrated facts" and warns to "never put invented experience, endorsement or results in a synthetic person's mouth."
  • Capability inventory: The skill possesses capabilities to perform network API calls to the vendor's services (mcp.magichour.ai), upload files, and generate video/audio assets.
  • Sanitization: The instructions mandate verifying all speech, names, numbers, and pronunciation against original facts before finalization.
  • [EXTERNAL_DOWNLOADS]: The skill fetches an OpenAPI schema from https://docs.magichour.ai/api-reference/openapi.json and utilizes an MCP server at https://mcp.magichour.ai/ to determine tool availability and execution parameters. These are vendor-owned resources hosted on the author's infrastructure. Additionally, the skill includes a reference to an external repository on GitHub (vargHQ/skills) for licensing and attribution purposes.
Audit Metadata
Risk Level
SAFE
Analyzed
Nov 3, 2026, 03:22 AM