persona-pack
Pass
Audited by Gen Agent Trust Hub on May 17, 2026
Risk Level: SAFE
Full Analysis
- [COMMAND_EXECUTION]: The script
download_videos_from_manifest_with_ytdlp.mjsexecutespython3 -m yt_dlpvia Node'sspawnto download video content. This is a standard and expected operation for a media production skill. - [EXTERNAL_DOWNLOADS]: The skill downloads media files from external URLs provided in manifest files. It also fetches data and uploads assets to the vendor's infrastructure at
api.postplus.com. These operations are well-documented and necessary for the skill's functionality. - [DATA_EXFILTRATION]: The skill manages authentication by reading and writing session tokens to the user's local configuration directory (e.g.,
~/.config/postplus/config.json). Access is restricted to the vendor's own configuration and is used exclusively for communicating with the PostPlus Cloud API. - [PROMPT_INJECTION]: The
SKILL.mdfile contains robust instructions designed to ensure personas are grounded in factual research rather than AI hallucinations. It specifically requires separating direct observations from prompt generation guidance to maintain data integrity.
Audit Metadata