happyhorse-by-acedatacloud
Pass
Audited by Gen Agent Trust Hub on Oct 22, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill ingests user-provided text prompts for video generation, creating a potential surface for indirect prompt injection.\n
- Ingestion points: User input provided to
happyhorse_generate_videoand related tools inSKILL.md.\n - Boundary markers:
SKILL.mdcontains strong instructions requiring the agent to obtain user approval for parameters and pricing before tool execution.\n - Capability inventory: Includes video generation, editing, and status polling tools via the Ace Data Cloud MCP server.\n
- Sanitization: The skill relies on natural language instructions to guide agent behavior rather than automated input sanitization.\n- [EXTERNAL_DOWNLOADS]: The skill connects to a remote Model Context Protocol (MCP) server at
https://happyhorse.mcp.acedata.cloud/mcpto perform video generation tasks. This endpoint is hosted on the vendor's infrastructure and is required for the skill's primary functionality.\n- [SAFE]: The skill implements best practices for secret management by using theACEDATACLOUD_API_TOKENenvironment variable for authentication instead of hardcoding API keys in the source code or manifest.
Audit Metadata