ig-carousel-planner
Pass
Audited by Gen Agent Trust Hub on Oct 5, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted user-supplied data such as topics and frameworks to generate slide text and captions.
- Ingestion points: User-provided topic and framework data ingested in Step 1 of SKILL.md.
- Boundary markers: The instructions lack explicit delimiters or safety instructions for interpolating user data into the generated drafts.
- Capability inventory: The skill has the ability to publish content to external platforms via lib.publish and generate images via lib.illustrate (SKILL.md).
- Sanitization: The risk is effectively managed by a mandatory 'Approval card' in Step 9 and a 'Humanizer pass' in Step 8, ensuring human review before publication.
- [SAFE]: The skill interacts exclusively with the well-known service Instagram for publication purposes via lib.publish.
- [SAFE]: No obfuscation, privilege escalation, or persistence mechanisms were identified in the skill scripts or documentation.
Audit Metadata