kling-v3.0-std
Pass
Audited by Gen Agent Trust Hub on Oct 9, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill uses a shell script (
generate_video.sh) to coordinate video generation tasks, involving calls tocurlfor API interaction andpython3for data processing and base64 encoding of image inputs. - [EXTERNAL_DOWNLOADS]: The script downloads generated video files from remote URLs provided by the video generation API after job completion using
curl. - [INDIRECT_PROMPT_INJECTION]: The skill processes user-supplied prompts and image files which could potentially contain adversarial instructions for the video generation model.
- Ingestion points: Text prompts via the
--promptargument and local or remote image files via--first-frame,--last-frame, and--reference-imageinscripts/generate_video.sh. - Boundary markers: The prompt and image data are encapsulated within a structured JSON payload before transmission to the API.
- Capability inventory: The skill has the capability to perform network requests (
curl) and read local files to encode them as base64 strings (python3). - Sanitization: The script validates several parameters (model, duration, resolution, aspect ratio) against strict allowlists and ensures numeric inputs for duration and CFG scale are within expected ranges.
Audit Metadata