linkedin-guest-kit
Pass
Audited by Gen Agent Trust Hub on Aug 19, 2026
Risk Level: SAFE
Full Analysis
- [EXTERNAL_DOWNLOADS]: The
scripts/generate.pyscript communicates with the Google Generative Language API (generativelanguage.googleapis.com) to generate and edit images. This is a well-known and trusted service used for its intended purpose. - [DATA_EXFILTRATION]: The skill manages API credentials by reading from a dedicated file in the user's home directory (
~/.gemini_api_key). The instructions include security best practices, specifically recommending restricted file permissions (chmod 600) to protect the API key. - [INDIRECT_PROMPT_INJECTION]: The workflow processes untrusted podcast transcripts to generate social media content and image prompts.
- Ingestion points: Podcast transcripts and guest photos are ingested as primary data sources for drafting posts and generating graphics.
- Boundary markers: The skill implements a "numbers ledger" system to track and verify factual statements from the transcript against the generated output.
- Capability inventory: The skill utilizes local file access and network communication with the Google Gemini API.
- Sanitization: Multiple manual review gates are integrated into the workflow (Step 3 and Step 5) to verify the accuracy, spelling, and accessibility of all generated content before delivery.
Audit Metadata