skills/doany-ai/skills/video-edit/Gen Agent Trust Hub

video-edit

Pass

Audited by Gen Agent Trust Hub on Oct 8, 2026

Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [COMMAND_EXECUTION]: The skill facilitates video editing by instructing the agent to invoke the RunComfy CLI (runcomfy run). It provides specific command templates for various editing models (Wan 2.7, Kling 2.6, Lucy Edit) and handles input via structured JSON payloads.
  • [EXTERNAL_DOWNLOADS]: The skill requires the installation of the @runcomfy/cli package from the NPM registry. Additionally, the CLI tool downloads generated video files from official vendor domains (*.runcomfy.net, *.runcomfy.com).
  • [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted external data in the form of user-provided text prompts and URLs for video and image assets. This creates a surface for indirect prompt injection where instructions could be embedded in the processed media or prompts to influence the behavior of the downstream AI models.
  • Ingestion points: video URL, image URL, reference_image URL, and prompt fields across all model routes in SKILL.md.
  • Boundary markers: The skill instructs the agent to use the --input flag with a JSON-formatted string to encapsulate user data.
  • Capability inventory: Execution of the runcomfy CLI and file writing to a user-defined --output-dir.
  • Sanitization: Documentation claims the CLI transmits the JSON body directly without shell expansion, reducing command injection risks but not preventing model-level prompt injection.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 8, 2026, 09:50 AM