static-to-motion

Pass

Audited by Gen Agent Trust Hub on Oct 24, 2026

Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
  • [INDIRECT_PROMPT_INJECTION]: The skill processes user-supplied images (static ads, product stills, etc.) to analyze layout and generate video prompts. This creates a vector where embedded text or visual patterns in the input image could attempt to influence the agent's output or tool parameters.
  • Ingestion points: User-uploaded static ad images referenced in SKILL.md.
  • Boundary markers: The skill uses explicit mode-based constraint blocks (e.g., SIMPLE constraints block) and specific prompt formatting to enforce fidelity.
  • Capability inventory: Utilizes arcads_analyze_media for content analysis and arcads_generate_video_seedance_20 for video synthesis.
  • Sanitization: Includes a Phase 5 QA gate that specifically checks for composition drift, brand text accuracy, and packaging geometry integrity before finalization.
  • [COMMAND_EXECUTION]: The skill documents an asset upload sequence that utilizes curl to transmit binary data to a presigned URL generated by the platform. This pattern involves executing shell commands to interact with external storage services.
  • Evidence: The skill specifies a sequence including curl -X PUT -H "Content-Type: <mime>" --data-binary @file "<presignedUrl>" to handle media uploads.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 24, 2026, 01:28 AM