skills/creativeclawco/creative-claw-marketplace/creativeclaw-cut-and-reframe-video/Gen Agent Trust Hub
creativeclaw-cut-and-reframe-video
Pass
Audited by Gen Agent Trust Hub on Sep 11, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted external data in the form of video source URLs, caption text, and transcript content, which could contain malicious instructions.
- Ingestion points: Untrusted data enters the agent context through the
video_urland thecaptionswords/text arrays defined inSKILL.mdandreferences/edit-contract.md. - Boundary markers: The instructions lack explicit prompt delimiters (such as XML tags or unique markers) to isolate untrusted caption or transcript text from the agent's core instructions.
- Capability inventory: The skill possesses capabilities for media editing (
cut_and_reframe_video), asset management (upload_asset,confirm_upload,import_media), and job monitoring (check_job) across all scripts. - Sanitization: Documentation in
SKILL.mdspecifies that "Caption text is verbatim," suggesting that external content is processed without filtering or escaping, which allows potentially malicious text to remain in the active context during the review and execution stages.
Audit Metadata