claude-video-create
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill guides the agent to process data inputs (such as JSON or CSV files, title strings, and subtitles) to dynamically create React components and parameterize video compositions. If this data comes from an untrusted source, it presents an indirect prompt injection surface that could attempt to influence agent behavior during code generation.
- Ingestion points: Data parameters, strings, and data arrays passed into the prompt or via command-line arguments like
--propsinSKILL.md. - Boundary markers: Absent. The instructions do not prescribe delimiters or specify that input text should be treated strictly as passive data rather than instructions.
- Capability inventory: The skill holds access to the
Bash,Read,Write, andEdittools, allowing it to execute local shell commands, install npm packages, and edit source code. - Sanitization: Absent. No verification or sanitization routines are specified for incoming data fields before they are embedded into generated code templates.
Audit Metadata