claude-video-generate
Pass
Audited by Gen Agent Trust Hub on Sep 20, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill utilizes the
Bashtool to execute local scripts, specificallyscripts/video_generate.pyandscripts/preflight.sh, to interface with video generation APIs and validate the environment. - [INDIRECT_PROMPT_INJECTION]: The skill instructions create a potential vulnerability surface by interpolating user-supplied text directly into shell commands via the
--promptargument. - Ingestion points: User-provided video descriptions in
SKILL.mdare passed as arguments to shell-executed Python scripts. - Boundary markers: While prompts are enclosed in double quotes in the examples, there are no instructions to escape or sanitize shell-sensitive characters like backticks (
`), semicolons (;), or command substitution syntax ($()). - Capability inventory: The agent has access to the
Bashtool and file system (Read,Write). - Sanitization: The instructions do not define any validation, filtering, or escaping protocols for external user input before execution.
Audit Metadata