sora-video
Pass
Audited by Gen Agent Trust Hub on Oct 8, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill mentions the optional installation of the
mcp-soraPython package to enable tool-use features. This resource is part of the vendor ecosystem for managing Sora video generation tasks. - [INDIRECT_PROMPT_INJECTION]: The skill provides a surface for indirect prompt injection by processing user-supplied prompts and external media URLs.
- Ingestion points:
prompt,image_urls, andcharacter_urlparameters in SKILL.md. - Boundary markers: None present in the skill instructions to delimit external content.
- Capability inventory: Performs network requests to the vendor's API endpoint (
api.acedata.cloud). - Sanitization: The instructions do not include steps for sanitizing or validating external URLs or prompt content before submission.
Audit Metadata