video-workflow
Pass
Audited by Gen Agent Trust Hub on Oct 1, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill ingests and acts upon data returned by the ArcReel MCP tools (
get_workflow_plan,get_generation_batch). This creates a surface where external content could influence the agent's behavior. - Ingestion points: Tool outputs describing project plans, task statuses, and batch results (SKILL.md).
- Boundary markers: The skill instructions explicitly warn against parsing natural language descriptions or explanations, requiring the agent to rely solely on structured status codes and action fields (references/generation-results.md, references/plan-safety.md).
- Capability inventory: The skill invokes tools for project creation, workflow planning, generation polling, and project migration.
- Sanitization: The design pattern of ignoring prose descriptions in favor of machine-readable fields acts as a validation boundary.
Audit Metadata