Automated Content Generation Pipeline Skill
Pass
Audited by Gen Agent Trust Hub on Jun 11, 2026
Risk Level: SAFEPROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [PROMPT_INJECTION]: The skill processes untrusted content scraped from TikTok, Instagram, and Reddit. This content is interpolated directly into AI prompts without sanitization or explicit instructions to disregard embedded commands, creating an indirect prompt injection surface.\n
- Ingestion points: Scraped viral content data ingested via Apify actors (SKILL.md).\n
- Boundary markers: Scraped content is interpolated inside JSON blocks within the prompt but lacks explicit delimiters or instructions to ignore embedded instructions (SKILL.md).\n
- Capability inventory: The skill has the capability to perform network operations via
axiosto publish content to platforms like Buffer or custom webhooks (SKILL.md).\n - Sanitization: No evidence of text sanitization, validation, or filtering of external data before prompt interpolation.\n- [EXTERNAL_DOWNLOADS]: The skill requires the installation of standard Node.js packages including
apify-client,axios,node-cron, anddotenv. These are well-known libraries used for the skill's stated functionality.
Audit Metadata