creativeclaw-minimax-h3-max

Pass

Audited by Gen Agent Trust Hub on Sep 6, 2026

Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill utilizes a Model Context Protocol (MCP) tool named creative-claw at https://app.creativeclaw.co/mcp/chatgpt. This is a vendor-owned resource hosted on the official creativeclaw.co domain.
  • [INDIRECT_PROMPT_INJECTION]: The skill is designed to process external media assets via URLs, which creates an ingestion point for untrusted data. While this presents a potential surface for indirect prompt injection, the skill defines a rigid prompt structure to isolate these references.
  • Ingestion points: The workflow in SKILL.md ingests external data through the image_url, last_frame_url, image_urls, video_urls, and audio_urls parameters.
  • Boundary markers: The skill enforces a structured prompt template (References, Shot, Subject, Action, Camera, Look, Audio, Continuity) which acts as a boundary to separate asset citations from instructions.
  • Capability inventory: The skill calls get_model_params and submit_feedback via the creative-claw MCP tool to perform video generation tasks.
  • Sanitization: There is no evidence of sanitization or validation of the content contained within the referenced media assets.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 6, 2026, 12:38 PM
Security Audit — agent-trust-hub — creativeclaw-minimax-h3-max