skills/tfcbot/rawugc-skills/ugc-saas/Gen Agent Trust Hub

ugc-saas

Pass

Audited by Gen Agent Trust Hub on Sep 21, 2026

Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
  • [INDIRECT_PROMPT_INJECTION]: The skill demonstrates an indirect prompt injection surface by interpolating untrusted user input directly into instructions for a video generation tool.
  • Ingestion points: User-supplied product names, features, and stories are used to replace [BRACKETED] placeholders in the prompt templates within SKILL.md.
  • Boundary markers: The instructions do not define clear delimiters or specific instructions for the agent to ignore potentially malicious commands embedded within user data.
  • Capability inventory: The skill is designed to trigger video generation via the rawugc-api skill using the POST /videos/generate endpoint.
  • Sanitization: There is no evidence of sanitization or validation instructions to handle malformed or adversarial user input before it is passed to the generation tool.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 21, 2026, 03:13 AM