creator-monetization
Pass
Audited by Gen Agent Trust Hub on Sep 22, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONNO_CODE
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill establishes an attack surface for indirect prompt injection by instructing the agent to ingest and analyze untrusted external content from X (Twitter) pages. 1. Ingestion points: Data is read from x.com/i/monetization, user profile pages, and follower lists. 2. Boundary markers: No delimiters or explicit warnings to ignore embedded instructions are present in the documentation. 3. Capability inventory: The skill performs data scraping, revenue tracking, and performance analytics via referenced scripts. 4. Sanitization: There is no evidence of validation, escaping, or filtering of the ingested external content.
- [NO_CODE]: Several functional scripts mentioned in the documentation (such as src/creatorStudio.js and src/subscriptionManager.js) are not included in the provided files, which prevents a comprehensive security evaluation of the execution logic.
Audit Metadata