eachlabs-video-generation
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill establishes an indirect prompt injection surface by processing untrusted user input, specifically through model prompts and external URLs for images, audio, and video references.
- Ingestion points: Inputs such as
prompt,image_url,audio_url, andvideo_urlinSKILL.mdand model schemas inreferences/MODELS.mdare passed to the API. - Boundary markers: The provided examples do not use explicit delimiters to isolate user-supplied prompts within the API payload.
- Capability inventory: The skill uses
curlto perform network operations against the EachLabs API. - Sanitization: No specific sanitization logic is described in the skill files; input safety relies on the EachLabs API safety checkers and agent-level guardrails.
- [COMMAND_EXECUTION]: The skill facilitates interaction with the EachLabs Predictions API through shell-based
curlcommands. These commands are used to submit generation tasks and poll for results, which is the core intended functionality of the skill. - [SAFE]: The skill is properly scoped to vendor-owned resources (
api.eachlabs.ai). It encourages secure practices by instructing the agent to use environment variables (EACHLABS_API_KEY) for authentication rather than requesting or hardcoding credentials.
Audit Metadata