generate-youtube-thumbnail
Pass
Audited by Gen Agent Trust Hub on Oct 30, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSDATA_EXFILTRATIONINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill coordinates its operations through a bash script (
scripts/generate-batch.sh), which executes system commands for image processing, directory management, and network communication. - [EXTERNAL_DOWNLOADS]: Fetches generated assets and status information from the Arcads API service (
external-api.arcads.ai). - [DATA_EXFILTRATION]: Performs necessary uploads of local reference images (such as subject faces and brand logos) to the Arcads API for use in generative image tasks.
- [DYNAMIC_EXECUTION]: Utilizes Python via heredocs within the shell script to perform image resizing and RGB conversion (using the Pillow library) and to safely handle JSON construction for API requests.
- [INDIRECT_PROMPT_INJECTION]: The skill ingests user-provided text for thumbnail titles and concepts, which are then interpolated into generation prompts.
- Ingestion points: Workflow step 1 in
SKILL.mdcaptures user input for 'Concept' and 'Text'. - Boundary markers: No explicit delimiters or instructions to ignore embedded commands are present in the prompt templates.
- Capability inventory: The skill possesses network access (
curl), file-writing capabilities (output/directory), and shell execution rights for the provided batch script. - Sanitization: User input is processed via the
PROMPTSarray and Python'sjson.dumps()in the batch script, but does not undergo explicit sanitization for model-specific injection patterns.
Audit Metadata