scenario
Pass
Audited by Gen Agent Trust Hub on Oct 18, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill utilizes official vendor endpoints (mcp.scenario.com) and documentation URLs (scenario.com), ensuring all network operations and references are directed to trusted infrastructure.
- [SAFE]: Credential management is handled securely. The instructions mandate the use of OAuth or manual operator-driven API key setup, and explicitly prohibit the agent from asking for, storing, encoding, or echoing secrets.
- [EXTERNAL_DOWNLOADS]: The setup documentation recommends the use of
mcp-remote, a standard and well-known bridge utility in the MCP ecosystem. This is a common and legitimate practice for connecting agents to HTTP-based MCP servers. - [COMMAND_EXECUTION]: The agent is instructed to use standard command-line tools like
curlto download and save generated assets from the platform's delivery network. This behavior is restricted to the skill's primary functional purpose. - [INDIRECT_PROMPT_INJECTION]: The skill processes natural language prompts and external assets for image and video generation. While this represents a surface for indirect prompt injection, the instructions mitigate potential risks by requiring explicit resolution of team and project scopes and relying on the platform's internal moderation and schema-validation layers.
Audit Metadata