noxinfluencer

Pass

Audited by Gen Agent Trust Hub on May 3, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: Fetches the noxinfluencer CLI package from the official NoxInfluencer GitHub repository. This resource is provided by the skill author for the intended functionality.
  • [COMMAND_EXECUTION]: Executes the noxinfluencer CLI to manage influencer marketing workflows. The skill implements safety guardrails such as mandatory dry-run previews and requiring a --force flag for state-changing operations only after user approval.
  • [CREDENTIALS_UNSAFE]: Uses the NOXINFLUENCER_API_KEY for authentication. The skill correctly directs the agent to ingest the key through secure standard input (--key-stdin) rather than command-line arguments to prevent credential exposure in process lists or logs.
  • [PROMPT_INJECTION]: Indirect Prompt Injection Surface. The skill ingests data from the NoxInfluencer API, which includes creator-generated content from YouTube, TikTok, and Instagram. This data is then processed and summarized by the agent.
  • Ingestion points: API response data retrieved via creator search, creator profile, and monitor tasks commands (documented in SKILL.md).
  • Boundary markers: The skill does not explicitly define markers or delimiters to isolate untrusted external content from the instruction context.
  • Capability inventory: The agent can execute the noxinfluencer CLI and perform file exports (documented in references/marketing-ops.md).
  • Sanitization: No explicit sanitization or filtering is described for the data ingested from the NoxInfluencer API.
Audit Metadata
Risk Level
SAFE
Analyzed
May 3, 2026, 07:44 PM