ai-video-generation
Pass
Audited by Gen Agent Trust Hub on Sep 14, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill directs users to install an external skill package and references remote installation instructions.
- Evidence: Recommends
npx skills add belt-sh/cliand links tohttps://raw.githubusercontent.com/inference-sh/skills/refs/heads/main/cli-install.mdfor CLI setup. - [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted external data (prompts and URLs) which are passed as arguments to the CLI tool.
- Ingestion points: User-supplied
prompt,image_url,video_url, andaudio_urlparameters used in the examples throughoutSKILL.md. - Boundary markers: Absent; the instructions do not provide delimiters or specific guidelines for the agent to treat these inputs strictly as data.
- Capability inventory: The skill uses the
Bash(belt *)tool to execute video generation commands. - Sanitization: Absent; there is no evidence of validation, filtering, or escaping of the user-provided prompts or URLs before they are interpolated into the shell command.
Audit Metadata