skills/ofoxai/skills/ugc-ads/Gen Agent Trust Hub

ugc-ads

Pass

Audited by Gen Agent Trust Hub on Sep 22, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill executes a shell script (ofox-video.sh) located in a sibling skill directory to perform environment checks and submit video generation jobs to the Ofox AI backend.
  • [EXTERNAL_DOWNLOADS]: The skill provides instructions to download and install its core dependency from the official vendor repository (ofoxai/skills) using standard tools like npx or specific platform installers.
  • [INDIRECT_PROMPT_INJECTION]: The skill processes user-supplied data to populate video generation prompts, creating an attack surface for indirect injection.
  • Ingestion points: User-provided product descriptions and responses to questions regarding video beats, subjects, and audio content in the SKILL.md file.
  • Boundary markers: Employs a structured prompt template with clearly labeled sections (e.g., STYLE, CAPTURE, SCENE, PRODUCT) and explicit 'AVOID' lists to delimit generated content.
  • Capability inventory: The skill utilizes shell command execution via a local script and requires network access for API communication.
  • Sanitization: Relies on structured data formatting and specific instructions for the agent to use proper command-line quoting when interpolating variables into shell commands.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 22, 2026, 08:46 AM