ugc-ads
Pass
Audited by Gen Agent Trust Hub on Sep 22, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes a shell script (
ofox-video.sh) located in a sibling skill directory to perform environment checks and submit video generation jobs to the Ofox AI backend. - [EXTERNAL_DOWNLOADS]: The skill provides instructions to download and install its core dependency from the official vendor repository (
ofoxai/skills) using standard tools likenpxor specific platform installers. - [INDIRECT_PROMPT_INJECTION]: The skill processes user-supplied data to populate video generation prompts, creating an attack surface for indirect injection.
- Ingestion points: User-provided product descriptions and responses to questions regarding video beats, subjects, and audio content in the SKILL.md file.
- Boundary markers: Employs a structured prompt template with clearly labeled sections (e.g., STYLE, CAPTURE, SCENE, PRODUCT) and explicit 'AVOID' lists to delimit generated content.
- Capability inventory: The skill utilizes shell command execution via a local script and requires network access for API communication.
- Sanitization: Relies on structured data formatting and specific instructions for the agent to use proper command-line quoting when interpolating variables into shell commands.
Audit Metadata