atlas-marketing-studio
Pass
Audited by Gen Agent Trust Hub on Jul 30, 2026
Risk Level: SAFEPROMPT_INJECTION
Full Analysis
- [PROMPT_INJECTION]: The skill uses direct string interpolation of user-controlled variables into LLM prompts without boundary markers or sanitization, creating a surface for indirect prompt injection.
- Ingestion points: The
generateAdScriptfunction inSKILL.md(and related API route snippets) takesproductName,targetAudience,tone, andlanguagedirectly from user input or external API requests. - Boundary markers: No delimiters (such as triple backticks or XML tags) or instructions to ignore embedded commands are present to separate user data from the system prompt instructions.
- Capability inventory: The generated script content is passed to downstream tools for Text-to-Speech (TTS) and lip-synced video generation via the Atlas Cloud API (
api.atlascloud.ai). - Sanitization: There is no evidence of input validation, escaping, or filtering for these strings before they are interpolated into the prompt string.
Audit Metadata