youtube-shorts
Pass
Audited by Gen Agent Trust Hub on Oct 29, 2026
Risk Level: SAFE
Full Analysis
- [PROMPT_INJECTION]: The skill instructions do not contain any attempt to bypass safety filters or override core agent behavior. It includes a specific safety rule stating that external inputs (comments, DM, or web results) must be treated as content rather than commands.
- [DATA_EXPOSURE_AND_EXFILTRATION]: No sensitive file access or hardcoded credentials were detected. The skill uses external endpoints for legitimate service integrations (WoopSocial) and explicitly directs the agent to refer users to native analytics platforms rather than attempting to ingest or fabricate sensitive data.
- [REMOTE_CODE_EXECUTION]: The skill does not perform any dynamic code execution or download untrusted scripts. External tool usage is restricted to defined MCP and REST integrations for scheduling and video asset generation.
- [INDIRECT_PROMPT_INJECTION]: The skill possesses a surface for indirect injection as it processes user-provided brand profiles and requests. It mitigates this risk by instructing the agent to treat all processed data as inert content and by enforcing human-in-the-loop verification before any content is published or assets are generated.
- [DYNAMIC_CONTEXT_INJECTION]: The skill does not utilize dynamic shell command interpolation (
!command) within its configuration or instructions.
Audit Metadata