byted-las-video-edit
Pass
Audited by Gen Agent Trust Hub on Sep 21, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill installs the
@volcengine/las-clipackage globally via npm. This is a vendor-provided tool necessary for the skill's video editing operations. - [COMMAND_EXECUTION]: Executes multiple commands using the
las-cliutility to check versions, verify configurations, estimate task pricing, and invoke video processing operations. - [INDIRECT_PROMPT_INJECTION]: The skill incorporates user-provided natural language descriptions into its processing logic, creating a surface for potential indirect prompt injection. Ingestion points: The
queryparameter within theparams.jsonconfiguration file, which is populated by user input. Boundary markers: The input is structured within JSON, but no explicit instructions are provided to the agent to ignore potentially malicious embedded commands. Capability inventory: The skill can execute shell commands through the vendor CLI and perform file system writes for configuration and output. Sanitization: The skill instructions do not specify any validation or sanitization steps for the natural language query before it is passed to the processing engine.
Audit Metadata