inboundfy-especialista-video

Pass

Audited by Gen Agent Trust Hub on Oct 12, 2026

Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
  • [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted content from external briefs and project files which are then interpolated into the generation flow.
  • Ingestion points: The process begins by reading an external brief (briefs/brief.md) and project configuration files (.inboundfy/fontes-projeto.md).
  • Boundary markers: The instructions mention "sentinelas" and framework contracts, but there are no explicit prompt delimiters (e.g., XML tags or unique separators) to isolate untrusted input from system instructions.
  • Capability inventory: The skill has the capability to write Markdown files to the filesystem and invoke multiple other agent skills (inboundfy-copy-editor, inboundfy-validador-video, inboundfy-planejamento).
  • Sanitization: There is no evidence of sanitization, escaping, or filtering of the input brief data before it is processed to create the video script.
  • [COMMAND_EXECUTION]: The skill references the execution of specific CLI tools or agent commands associated with the vendor's ecosystem.
  • Evidence: The instructions direct the agent to utilize inboundfy-setup for environment repair and inboundfy-copy-editor for post-generation text analysis. These are identified as internal resources belonging to the author 'promovaweb'.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 12, 2026, 12:47 AM