ecommerce-video-ads

Pass

Audited by Gen Agent Trust Hub on Nov 1, 2026

Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [INDIRECT_PROMPT_INJECTION]: The skill processes user-supplied product facts, claims, and customer reviews to generate video scripts and AI generation prompts. While this presents a potential surface for indirect prompt injection, the skill includes explicit instructions for fact-checking, compliance with advertising standards (e.g., FTC rules on testimonials), and uses boundary markers (e.g., '@image1 defines the product ONLY') to scope model behavior. Findings indicate a low-risk surface managed by the skill's safety guidelines.
  • [COMMAND_EXECUTION]: The skill is configured to use Bash(curl:*) for API communication with Varg's servers and Bash(ffmpeg:*) for local video processing. These capabilities are directly aligned with the skill's primary purpose of estimating costs, generating video content via external AI models, and editing the results. No suspicious or unauthorized command patterns were found.
  • [EXTERNAL_DOWNLOADS]: The skill interacts with varg.ai (the author's platform) to estimate credits and generate video assets. It also references numerous external resources for platform policies and marketing research, including TikTok, Meta, the FTC, and various industry benchmarks. These external references are informative and originate from well-known or trusted services.
Audit Metadata
Risk Level
SAFE
Analyzed
Nov 1, 2026, 12:01 PM