clone-video-ad
Pass
Audited by Gen Agent Trust Hub on Aug 13, 2026
Risk Level: SAFEPROMPT_INJECTIONEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [PROMPT_INJECTION]: The skill processes external video files and their transcripts to generate advertising prompts, creating a surface for indirect prompt injection. Ingestion points: source video files (SKILL.md Step 1) and API transcripts (SKILL.md Step 2). Boundary markers: Absent; no delimiters or instructions to ignore embedded commands are used. Capability inventory: Shell execution of ffmpeg, network operations via curl, and file system access. Sanitization: Absent; no validation or escaping of transcript content is described before interpolation into prompts.
- [EXTERNAL_DOWNLOADS]: The skill installs ffmpeg via Homebrew and openai-whisper via pip. It also provides instructions for fetching scripts and documentation from the vendor's repository (github.com/novoads/claude-code-ads). These sources are well-known or vendor-controlled.
- [COMMAND_EXECUTION]: Executes ffmpeg for media processing and curl for interacting with the Novoads API, which are essential and legitimate operations for the skill's declared purpose.
Audit Metadata