p-video

Pass

Audited by Gen Agent Trust Hub on Sep 2, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill facilitates the installation of the belt-sh/cli tool via npx skills add and references installation instructions hosted on GitHub at raw.githubusercontent.com/inference-sh/skills/refs/heads/main/cli-install.md. These resources originate from the official repository of the inference.sh service.
  • [COMMAND_EXECUTION]: The skill utilizes the belt CLI tool to interact with the inference.sh platform. Commands such as belt login, belt app run, and belt app list are documented to perform video generation, authentication, and service discovery.
  • [INDIRECT_PROMPT_INJECTION]: The skill has an attack surface for indirect prompt injection as it processes user-provided prompts, image URLs, and audio URLs which are then passed as arguments to the belt CLI tool.
  • Ingestion points: User input for prompt, image, and audio fields in the JSON input to belt app run commands.
  • Boundary markers: None explicitly defined in the provided command templates.
  • Capability inventory: The skill uses the Bash tool to execute the belt CLI, which performs network operations to the inference.sh API.
  • Sanitization: There is no explicit sanitization or escaping shown for the user-provided strings before they are interpolated into the shell command.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 2, 2026, 02:18 PM
Security Audit — agent-trust-hub — p-video