generate-youtube-thumbnail

Pass

Audited by Gen Agent Trust Hub on Oct 30, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSDATA_EXFILTRATIONINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill coordinates its operations through a bash script (scripts/generate-batch.sh), which executes system commands for image processing, directory management, and network communication.
  • [EXTERNAL_DOWNLOADS]: Fetches generated assets and status information from the Arcads API service (external-api.arcads.ai).
  • [DATA_EXFILTRATION]: Performs necessary uploads of local reference images (such as subject faces and brand logos) to the Arcads API for use in generative image tasks.
  • [DYNAMIC_EXECUTION]: Utilizes Python via heredocs within the shell script to perform image resizing and RGB conversion (using the Pillow library) and to safely handle JSON construction for API requests.
  • [INDIRECT_PROMPT_INJECTION]: The skill ingests user-provided text for thumbnail titles and concepts, which are then interpolated into generation prompts.
  • Ingestion points: Workflow step 1 in SKILL.md captures user input for 'Concept' and 'Text'.
  • Boundary markers: No explicit delimiters or instructions to ignore embedded commands are present in the prompt templates.
  • Capability inventory: The skill possesses network access (curl), file-writing capabilities (output/ directory), and shell execution rights for the provided batch script.
  • Sanitization: User input is processed via the PROMPTS array and Python's json.dumps() in the batch script, but does not undergo explicit sanitization for model-specific injection patterns.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 30, 2026, 03:11 AM