novoads-claymation-ad
Pass
Audited by Gen Agent Trust Hub on Aug 13, 2026
Risk Level: SAFEPROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes user-supplied reference videos using ffmpeg and Whisper to extract narrative beats and dialogue, which are then used to build prompts for the Novoads API. This pattern introduces a risk where instructions embedded in reference media could manipulate the agent's behavior. \n
- Ingestion points: SKILL.md (Entry B: processing reference videos locally). \n
- Boundary markers: No specific delimiters or instructions to ignore embedded content are documented for external data interpolation. \n
- Capability inventory: Execution of local command-line tools (ffmpeg, Whisper) and network communication with the Novoads API. \n
- Sanitization: No explicit sanitization or filtering of text extracted from media is mentioned. \n- [COMMAND_EXECUTION]: The skill instructs users to run local shell scripts for environment setup and verification (
./scripts/setup.sh,./scripts/check-novoads-env.sh) and requires the use of command-line utilities likeffmpegandjqfor its primary workflow.
Audit Metadata