marketing-ad-creative
Pass
Audited by Gen Agent Trust Hub on Sep 27, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill provides instructions for installing and utilizing several third-party creative tools. These include Remotion for code-based video rendering, the Voicebox open-source voice cloning tool (via git clone), and the Gooseworks ad-automation skill (via npx). These are well-documented tools within the creative development ecosystem.
- [COMMAND_EXECUTION]: The skill documentation includes examples of using command-line interface (CLI) scripts to fetch performance data from established advertising platforms such as Google Ads, Meta Ads, and LinkedIn Ads. It also describes using
ffmpegfor local audio-visual assembly, which is standard practice for media production workflows. - [INDIRECT_PROMPT_INJECTION]: The skill ingests external data from customer reviews, ad comments, and performance metrics. To mitigate the risk of the model following malicious instructions embedded in this data, the skill enforces 'Grounded Input' rules, requiring every generated concept to cite specific source material. Additionally, it instructs the agent to sanitize any untrusted text before interpolating it into the generated HTML review pages.
- [DYNAMIC_EXECUTION]: The provided 'Creative Review Page' template utilizes client-side JavaScript to render interactive previews from a JSON data block. This functionality is implemented with security in mind, utilizing a robust HTML entity escaping function and specific instructions to escape tag-breaking characters (<) as a defense-in-depth measure.
Audit Metadata