ad-creative
Pass
Audited by Gen Agent Trust Hub on Aug 22, 2026
Risk Level: SAFEPROMPT_INJECTIONCOMMAND_EXECUTIONREMOTE_CODE_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes external performance data and local marketing context files to generate and iterate on ad creative.
- Ingestion points: CSV or API-sourced performance metrics in
Mode 2and context from.agents/product-marketing.md. - Boundary markers: The instructions do not define specific delimiters or directives to ignore instructions within the ingested data.
- Capability inventory: The skill uses local CLI tools (
google-ads.js) and network operations viacurlfor API interactions. - Sanitization: There are no explicit steps for sanitizing or validating external data before it is interpolated into prompts.\n- [REMOTE_CODE_EXECUTION]: The skill provides shell command examples for the user to execute, such as
curlfor interacting with external APIs (including Gemini and ElevenLabs) andnodefor executing local ad platform management scripts.\n- [EXTERNAL_DOWNLOADS]: The documentation references external tools and repositories, including a GitHub repository for theVoiceboxvoice synthesis studio.\n- [DYNAMIC_EXECUTION]: The skill utilizesRemotion, a framework that renders video by executing React code at runtime. It encourages the use of data-driven templates where external JSON data is injected into React components for batch production.
Audit Metadata