linkpix-viral-video-clone
Pass
Audited by Gen Agent Trust Hub on Sep 11, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill provides instructions to download Node.js binaries and associated checksums from the official nodejs.org distribution server. This is a legitimate environment setup step that includes a mandatory integrity check using sha256sum to ensure the file's authenticity.
- [COMMAND_EXECUTION]: Directs the agent to perform administrative tasks such as installing the official CLI tool via npm and executing local utility scripts for image optimization. The image processing logic uses standard, well-known libraries like Pillow or Sharp.
- [INDIRECT_PROMPT_INJECTION]: The skill processes content from external video sharing platforms.
- Ingestion points: External video URLs (resourceUrl) and user-provided prompts.
- Boundary markers: The instructions require the agent to present inferred scripts for user review and obtain explicit confirmation before submitting tasks.
- Capability inventory: Relies on a specific vendor-provided CLI for processing rather than arbitrary shell execution of untrusted data.
- Sanitization: Includes checks for image dimensions, file sizes, and model label validation against a live list to prevent exploitation of downstream tools.
Audit Metadata