platform-specs-and-validation
Pass
Audited by Gen Agent Trust Hub on Oct 29, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to process and map user-provided content (captions and media) into platform-specific API structures.
- Ingestion points: User input enters the context through content craft tasks described in
SKILL.mdandreferences/woopsocial-publish-spec.md. - Boundary markers: The skill does not define specific delimiters (like XML tags) to separate untrusted user captions from the prompt instructions.
- Capability inventory: The skill possesses the capability to perform network operations via
POST /postsandPOST /posts/validateusing thewoopsocialtool integration. - Sanitization: The workflow relies on an external validation endpoint to catch specification errors, but does not explicitly instruct the agent to sanitize user-provided text for prompt injection patterns before interpolation into API payloads.
- [SAFE]: The skill follows security best practices by including clear instructions to never bypass validation or manipulate safety/disclosure flags (such as
isBrandedContentormadeForKids) to clear errors. It maintains a clear separation of concerns, routing creative tasks and scheduling to other skills while focusing strictly on technical compliance.
Audit Metadata