gen-ai-explainer
Warn
Audited by Gen Agent Trust Hub on Aug 15, 2026
Risk Level: MEDIUMCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill instructs the agent to interpolate potentially untrusted strings, such as project titles and slugs derived from external research, directly into shell commands. In
references/render-director.md, the commandgen-ai upload-to-drive <slug>/explainer.mp4 --name "<title>"is used. If the generated title contains shell metacharacters like double quotes or semicolons, it could lead to command injection depending on the shell environment and executor. - [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data via
WebSearchandWebFetchwhich then influences script generation and project parameters without proper sanitization. - Ingestion points:
references/research-director.mdusesWebSearchandWebFetchto gather topic research, trending signals, and audience questions from the open web. - Boundary markers: The instructions lack clear delimiters or specific warnings to ignore instructions embedded in the retrieved web content.
- Capability inventory: The skill can execute multiple shell commands via the
gen-aiCLI (explainer:assets,explainer:render,upload-to-drive,credits,pricing) and performs local file writes (script.json,scene-plan.json). - Sanitization: No explicit sanitization or validation of the fetched content is specified before it is used to influence the video script or project parameters. This could also be used to trigger "auto mode" via keyword injection (e.g., "yolo", "no checks"), bypassing credit-spending approval gates.
Audit Metadata