post-content
Pass
Audited by Gen Agent Trust Hub on Jul 30, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill interacts with the Late API (getlate.dev) and Google Drive services to manage and publish media content.
- [COMMAND_EXECUTION]: Provides instructions for executing Python scripts using the "requests" library to interact with the Late API and includes an "ffmpeg" command for video compression tasks.
- [DATA_EXPOSURE]: Accesses the "~/YourProject/.env" file to retrieve the "LATE_API_KEY", which is a standard method for managing API credentials in this context.
- [PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection as it processes untrusted data from external sources.
- Ingestion points: Reads content from Airtable fields ("Caption", "Title", "Review File URL") and Google Drive file names/metadata.
- Boundary markers: Explicitly warns in the "SKILL.md" header that third-party or scraped content is untrusted and should not dictate critical logic.
- Capability inventory: Includes capabilities for network requests (via "requests"), file management (via "move_file"), and database updates (via Airtable update tools).
- Sanitization: Employs mandatory preflight checks for both URLs and captions to ensure data validity and integrity before submission to the API.
Audit Metadata