eachlabs-video-generation

Pass

Audited by Gen Agent Trust Hub on Sep 15, 2026

Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
  • [INDIRECT_PROMPT_INJECTION]: The skill establishes an indirect prompt injection surface by processing untrusted user input, specifically through model prompts and external URLs for images, audio, and video references.
  • Ingestion points: Inputs such as prompt, image_url, audio_url, and video_url in SKILL.md and model schemas in references/MODELS.md are passed to the API.
  • Boundary markers: The provided examples do not use explicit delimiters to isolate user-supplied prompts within the API payload.
  • Capability inventory: The skill uses curl to perform network operations against the EachLabs API.
  • Sanitization: No specific sanitization logic is described in the skill files; input safety relies on the EachLabs API safety checkers and agent-level guardrails.
  • [COMMAND_EXECUTION]: The skill facilitates interaction with the EachLabs Predictions API through shell-based curl commands. These commands are used to submit generation tasks and poll for results, which is the core intended functionality of the skill.
  • [SAFE]: The skill is properly scoped to vendor-owned resources (api.eachlabs.ai). It encourages secure practices by instructing the agent to use environment variables (EACHLABS_API_KEY) for authentication rather than requesting or hardcoding credentials.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 15, 2026, 05:55 AM