static-to-motion
Pass
Audited by Gen Agent Trust Hub on Oct 24, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes user-supplied images (static ads, product stills, etc.) to analyze layout and generate video prompts. This creates a vector where embedded text or visual patterns in the input image could attempt to influence the agent's output or tool parameters.
- Ingestion points: User-uploaded static ad images referenced in SKILL.md.
- Boundary markers: The skill uses explicit mode-based constraint blocks (e.g., SIMPLE constraints block) and specific prompt formatting to enforce fidelity.
- Capability inventory: Utilizes
arcads_analyze_mediafor content analysis andarcads_generate_video_seedance_20for video synthesis. - Sanitization: Includes a Phase 5 QA gate that specifically checks for composition drift, brand text accuracy, and packaging geometry integrity before finalization.
- [COMMAND_EXECUTION]: The skill documents an asset upload sequence that utilizes
curlto transmit binary data to a presigned URL generated by the platform. This pattern involves executing shell commands to interact with external storage services. - Evidence: The skill specifies a sequence including
curl -X PUT -H "Content-Type: <mime>" --data-binary @file "<presignedUrl>"to handle media uploads.
Audit Metadata