brand-kit

Pass

Audited by Gen Agent Trust Hub on Sep 11, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill requires the installation of the video-studio-engine package from the developer's GitHub repository (https://github.com/scrollmark/social-skills/archive/refs/heads/master.tar.gz). This is a documented vendor-controlled dependency.\n- [COMMAND_EXECUTION]: The skill interacts with the local system using the video-studio CLI utility to manage branding assets, including listing, applying, and saving style presets.\n- [INDIRECT_PROMPT_INJECTION]: The skill creates an attack surface by processing user-provided descriptions of brand kits and saving them into persistent JSON configuration files, which could potentially ingest malicious instructions.\n
  • Ingestion points: User descriptions of brand looks, including fonts, colors, and CTA copy.\n
  • Boundary markers: No explicit delimiters or instructions are specified to isolate user input from system-processed data.\n
  • Capability inventory: The skill possesses file-write capabilities through the video-studio styles --save command, targeting the user's config directory (~/.config/video-studio/styles/).\n
  • Sanitization: The video-studio tool performs basic validation by flagging and reporting any unknown keys in the brand JSON block.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 11, 2026, 12:59 PM