creative-insights-api
Pass
Audited by Gen Agent Trust Hub on Sep 22, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill instructs the agent to construct and execute
curlcommands to interact with a web API. - [EXTERNAL_DOWNLOADS]: The skill performs network operations targeting
https://builder-be.staging.motionapp.com/api/creative-insights. This domain is associated with the skill's authoring organization. - [INDIRECT_PROMPT_INJECTION]: The skill ingests user input to dynamically build shell commands, creating an interface where untrusted data influences execution.
- Ingestion points: User-provided query criteria such as format, sorting, and date ranges (SKILL.md).
- Boundary markers: None present; the skill relies on the agent to correctly parse and interpolate parameters into a shell string.
- Capability inventory: Execution of shell commands via
curl(SKILL.md). - Sanitization: The instructions advise parsing the request but lack explicit guidance on shell escaping or parameter validation to prevent command injection.
Audit Metadata