ad-creative
Pass
Audited by Gen Agent Trust Hub on Apr 12, 2026
Risk Level: SAFEPROMPT_INJECTIONEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONCOMMAND_EXECUTION
Full Analysis
- [PROMPT_INJECTION]: The skill implements an 'Iterate from Performance Data' mode where it ingests external data (CSV, text pastes, or API outputs) to analyze ad performance. This creates a surface for indirect prompt injection, as malicious instructions embedded within the performance metrics or ad text strings could potentially influence the agent's behavior.
- [EXTERNAL_DOWNLOADS]: The documentation provides instructions for setting up third-party creative tools, including fetching the Voicebox repository from GitHub (github.com/jamiepine/voicebox) and using the npx package runner for Remotion development.
- [REMOTE_CODE_EXECUTION]: The skill references commands that download and execute code from remote registries, specifically 'npx create-video@latest' for initializing Remotion projects. It also includes build instructions ('make setup') for external source code, which is presented as a standard workflow for professional video production.
- [COMMAND_EXECUTION]: The skill utilizes local CLI tools to manage advertising workflows, such as 'node tools/clis/google-ads.js' for pulling performance reports and managing campaigns on various platforms.
Audit Metadata