generate-clip
Pass
Audited by Gen Agent Trust Hub on Oct 29, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill instructs the agent to download generated video content from remote URLs, specifically outputs from the Replicate service, using the
curlcommand. Replicate is a well-known AI model hosting platform. - [COMMAND_EXECUTION]: The workflow includes the execution of shell commands such as
mkdirto prepare directories andcurlto save generated media files to the localpublic/footage/directory. - [INDIRECT_PROMPT_INJECTION]: The skill processes text prompts and external image URLs provided by the user or external tools to generate new content, which represents an indirect prompt injection surface.
- Ingestion points: The
promptandimage_urlsfields in thegenerate_video_from_text,generate_video_from_image, and Replicate prediction tool calls inSKILL.md. - Boundary markers: No explicit delimiters or instructions to ignore embedded commands are present when interpolating user data into generation prompts.
- Capability inventory: The skill possesses file write capabilities via
curland network access through the generation toolsets (remotion-mediaandreplicate-mcp). - Sanitization: No specific sanitization, filtering, or validation steps are outlined for the external data before it is passed to the generation models.
Audit Metadata