brainrotshorts

Pass

Audited by Gen Agent Trust Hub on Jul 19, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill facilitates the ingestion of external media and data through its tools.
  • Evidence: The reddit_post_fetch and reddit_video_create_from_url tools in references/mcp.md download content from Reddit. The overlay_image_upload tool allows fetching images from arbitrary user-provided URLs.
  • [PROMPT_INJECTION]: The skill has an indirect prompt injection surface due to its ability to process untrusted external data from Reddit.
  • Ingestion points: External content fetched via reddit_post_fetch and reddit_video_create_from_url (documented in references/mcp.md).
  • Boundary markers: No explicit delimiter-based prompt interpolation markers are defined for the fetched external content.
  • Capability inventory: The skill can perform irreversible or credit-consuming actions such as render_start, project_delete, and overlay_render (documented in references/mcp.md).
  • Sanitization: The references/content-workflows.md file provides mitigation via a 'Review before rendering' checklist and instructions to remove PII from Reddit posts.
Audit Metadata
Risk Level
SAFE
Analyzed
Jul 19, 2026, 04:18 PM
Security Audit — agent-trust-hub — brainrotshorts