video-ad-specs
Pass
Audited by Gen Agent Trust Hub on Sep 2, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill instructs users to install the
belt-sh/clitool vianpxand references external documentation and configuration files hosted atraw.githubusercontent.com/inference-sh/skills. These resources are central to the skill's stated purpose of video generation via theinference.shplatform.- [INDIRECT_PROMPT_INJECTION]: The skill provides numerous command-line examples (e.g., inSKILL.md) that interpolate user-provided prompts directly into JSON input objects for thebeltCLI. This architecture lacks input sanitization or boundary markers, creating a surface where malicious instructions embedded in processed data could attempt to influence the agent's behavior or the output of the video generation tools.\n - Ingestion points: CLI command templates in
SKILL.mdthat accept user-defined--inputstrings.\n - Boundary markers: Absent; user prompts are placed directly inside JSON structures without escaping or delimiters.\n
- Capability inventory: Execution of the
beltCLI tool via shell commands.\n - Sanitization: None detected in the provided templates.- [COMMAND_EXECUTION]: The skill's primary functionality is delivered through the execution of shell commands using the
beltCLI tool to interface with remote video generation models.
Audit Metadata