brand-kit
Pass
Audited by Gen Agent Trust Hub on Sep 11, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill requires the installation of the
video-studio-enginepackage from the developer's GitHub repository (https://github.com/scrollmark/social-skills/archive/refs/heads/master.tar.gz). This is a documented vendor-controlled dependency.\n- [COMMAND_EXECUTION]: The skill interacts with the local system using thevideo-studioCLI utility to manage branding assets, including listing, applying, and saving style presets.\n- [INDIRECT_PROMPT_INJECTION]: The skill creates an attack surface by processing user-provided descriptions of brand kits and saving them into persistent JSON configuration files, which could potentially ingest malicious instructions.\n - Ingestion points: User descriptions of brand looks, including fonts, colors, and CTA copy.\n
- Boundary markers: No explicit delimiters or instructions are specified to isolate user input from system-processed data.\n
- Capability inventory: The skill possesses file-write capabilities through the
video-studio styles --savecommand, targeting the user's config directory (~/.config/video-studio/styles/).\n - Sanitization: The
video-studiotool performs basic validation by flagging and reporting any unknown keys in the brand JSON block.
Audit Metadata