minimax-h3-max
Pass
Audited by Gen Agent Trust Hub on Oct 7, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The generate_video.sh script utilizes curl for API interactions and python3 for necessary data transformations, such as base64 encoding images and assembling JSON payloads. These executions are scoped to the skill's documented functionality.
- [EXTERNAL_DOWNLOADS]: The skill is designed to download generated video content from the Frevana API endpoint. This process is triggered after a successful generation job and uses standard curl operations.
- [INDIRECT_PROMPT_INJECTION]: The skill processes user-provided prompts and images to generate video content.
- Ingestion points: Inputs are received via --prompt, --first-frame, and --last-frame CLI arguments in generate_video.sh.
- Boundary markers: User inputs are encapsulated in a structured JSON payload using Python's json.dump, ensuring they are treated as data rather than instructions during transmission.
- Capability inventory: The skill has the ability to perform network requests (curl) and read/write local files as specified by the user.
- Sanitization: Inputs are sanitized through JSON serialization before being sent to the remote API.
Audit Metadata