story-audit
Pass
Audited by Gen Agent Trust Hub on Oct 9, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from Instagram captions to classify hook types. While it does not specify explicit boundary markers for these captions, the risk is low as the agent is tasked with analytical classification rather than executing the content, and no high-privilege capabilities are exposed to this data.
- Ingestion points: Instagram media captions fetched via API or Ootto plugin.
- Boundary markers: Not explicitly defined in the prompt instructions.
- Capability inventory: None. The skill only generates a text report and does not perform file writes, shell commands, or network sends of sensitive data.
- Sanitization: None mentioned for the ingested caption strings.
- [EXTERNAL_DOWNLOADS]: The skill fetches reel metadata and insights from the Instagram Graph API (
graph.facebook.com) and utilizes the Ootto plugin. These are well-known services and vendor-specific tools necessary for the skill's primary function of social media auditing.
Audit Metadata