generate-clip

Pass

Audited by Gen Agent Trust Hub on Oct 29, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill instructs the agent to download generated video content from remote URLs, specifically outputs from the Replicate service, using the curl command. Replicate is a well-known AI model hosting platform.
  • [COMMAND_EXECUTION]: The workflow includes the execution of shell commands such as mkdir to prepare directories and curl to save generated media files to the local public/footage/ directory.
  • [INDIRECT_PROMPT_INJECTION]: The skill processes text prompts and external image URLs provided by the user or external tools to generate new content, which represents an indirect prompt injection surface.
  • Ingestion points: The prompt and image_urls fields in the generate_video_from_text, generate_video_from_image, and Replicate prediction tool calls in SKILL.md.
  • Boundary markers: No explicit delimiters or instructions to ignore embedded commands are present when interpolating user data into generation prompts.
  • Capability inventory: The skill possesses file write capabilities via curl and network access through the generation toolsets (remotion-media and replicate-mcp).
  • Sanitization: No specific sanitization, filtering, or validation steps are outlined for the external data before it is passed to the generation models.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 29, 2026, 03:03 PM