skills/doany-ai/skills/video-extend/Gen Agent Trust Hub

video-extend

Pass

Audited by Gen Agent Trust Hub on Oct 8, 2026

Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [INDIRECT_PROMPT_INJECTION]: The skill processes external video content provided via a URL, which represents a surface for indirect instructions to be passed to the model (e.g., via text in frames or metadata). * Ingestion points: The video_url input parameter in the runcomfy run command located in SKILL.md. * Boundary markers: Input is passed as a structured JSON string to the CLI to prevent shell injection, as documented in the security section. * Capability inventory: The skill uses the Bash(runcomfy *) tool to execute video processing commands and write outputs to the local filesystem (./out). * Sanitization: The skill advises agents to only use user-provided URLs and provides guidance on detecting model divergence caused by untrusted input.
  • [COMMAND_EXECUTION]: The skill invokes the runcomfy CLI via bash to perform video extension tasks, login, and installation.
  • [EXTERNAL_DOWNLOADS]: The skill requires the installation of the @runcomfy/cli package from the public npm registry, which is the official tool provided by the skill author.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 8, 2026, 09:50 AM