infinitetalk-shopping-avatar
Pass
Audited by Gen Agent Trust Hub on Jul 27, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill provides integration instructions in
references/cross-tool-integration.mdthat usesubprocess.runto executeffmpeg. This is intended for the legitimate purpose of concatenating individual video scenes into a complete 25-second video file. - [EXTERNAL_DOWNLOADS]: The documentation references local paths for pre-trained model weights, such as
Wan2.1-I2V-14B-480Pandchinese-wav2vec2-base. While the skill assumes these are pre-installed in the environment, they represent external dependencies required for model inference. - [PROMPT_INJECTION]: The skill processes user-supplied data, including product information and emotional tones, and interpolates them into highly structured prompts for video generation. This creates an indirect prompt injection surface where untrusted user input could potentially influence the instructions sent to downstream generative models.
Audit Metadata