blitzreels-cli
Pass
Audited by Gen Agent Trust Hub on May 8, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill enables an AI agent to interact with the BlitzReels platform using shell commands via the
npx blitzreelsinterface. - [EXTERNAL_DOWNLOADS]: The skill instructions involve downloading and executing the
blitzreelsand@blitzreels/clipackages from the npm registry. These resources are authored by the skill's vendor and are used for their intended purpose. - [PROMPT_INJECTION]: The skill exhibits an indirect prompt injection surface because it processes external data from video projects, such as captions and metadata. 1. Ingestion points: Untrusted data enters the agent context through commands like
project inspect,project timeline, andcaptions words listinSKILL.md. 2. Boundary markers: The skill recommends using the--jsonflag for machine-readable output but does not define specific prompt delimiters to isolate ingested text. 3. Capability inventory: The agent is granted capabilities to perform significant modifications, including deleting projects, uploading files, and initiating video exports. 4. Sanitization: There are no specific instructions for sanitizing or escaping the content retrieved from the BlitzReels API before it is processed by the agent. - [SAFE]: The skill incorporates several safety measures, including clear warnings against sharing API keys in logs or chat and requiring manual confirmation for actions that delete data or consume account credits.
Audit Metadata