blitzreels-cli

Pass

Audited by Gen Agent Trust Hub on May 8, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill enables an AI agent to interact with the BlitzReels platform using shell commands via the npx blitzreels interface.
  • [EXTERNAL_DOWNLOADS]: The skill instructions involve downloading and executing the blitzreels and @blitzreels/cli packages from the npm registry. These resources are authored by the skill's vendor and are used for their intended purpose.
  • [PROMPT_INJECTION]: The skill exhibits an indirect prompt injection surface because it processes external data from video projects, such as captions and metadata. 1. Ingestion points: Untrusted data enters the agent context through commands like project inspect, project timeline, and captions words list in SKILL.md. 2. Boundary markers: The skill recommends using the --json flag for machine-readable output but does not define specific prompt delimiters to isolate ingested text. 3. Capability inventory: The agent is granted capabilities to perform significant modifications, including deleting projects, uploading files, and initiating video exports. 4. Sanitization: There are no specific instructions for sanitizing or escaping the content retrieved from the BlitzReels API before it is processed by the agent.
  • [SAFE]: The skill incorporates several safety measures, including clear warnings against sharing API keys in logs or chat and requiring manual confirmation for actions that delete data or consume account credits.
Audit Metadata
Risk Level
SAFE
Analyzed
May 8, 2026, 11:24 AM