advibly-collage-motion
Pass
Audited by Gen Agent Trust Hub on Jul 10, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill includes a shell script snippet for video concatenation using
ffmpeg. This script is intended for environments with shell access (such as Claude Code) to automate the assembly of generated video clips into a final advertisement. - [EXTERNAL_DOWNLOADS]: The provided shell script uses
curlto download generated video files from Advibly's platform. This is a functional requirement for local video processing and assembly of the ads. - [PROMPT_INJECTION]: The skill implements a workflow to decode user-provided reference images into a structured JSON specification, which is then used to generate new prompts. This creates an indirect prompt injection surface where untrusted data (reference images) could influence model output; however, this behavior is central to the skill's purpose and uses a structured intermediate format to maintain consistency.
Audit Metadata