inboundfy-especialista-video
Pass
Audited by Gen Agent Trust Hub on Oct 12, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted content from external briefs and project files which are then interpolated into the generation flow.
- Ingestion points: The process begins by reading an external brief (
briefs/brief.md) and project configuration files (.inboundfy/fontes-projeto.md). - Boundary markers: The instructions mention "sentinelas" and framework contracts, but there are no explicit prompt delimiters (e.g., XML tags or unique separators) to isolate untrusted input from system instructions.
- Capability inventory: The skill has the capability to write Markdown files to the filesystem and invoke multiple other agent skills (
inboundfy-copy-editor,inboundfy-validador-video,inboundfy-planejamento). - Sanitization: There is no evidence of sanitization, escaping, or filtering of the input brief data before it is processed to create the video script.
- [COMMAND_EXECUTION]: The skill references the execution of specific CLI tools or agent commands associated with the vendor's ecosystem.
- Evidence: The instructions direct the agent to utilize
inboundfy-setupfor environment repair andinboundfy-copy-editorfor post-generation text analysis. These are identified as internal resources belonging to the author 'promovaweb'.
Audit Metadata