kling-video
Pass
Audited by Gen Agent Trust Hub on Aug 11, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill requires the installation of the
@runapi.ai/klingpackage from the NPM registry to interact with the Kling AI API. - [COMMAND_EXECUTION]: Documentation includes a standard installation command (
npm install @runapi.ai/kling) intended for the developer's environment setup. - [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted user data via video generation prompts (e.g., in
client.textToVideo.run). - Ingestion points: User-provided strings passed to the
promptandmulti_promptparameters in SKILL.md. - Boundary markers: None provided in the instruction templates.
- Capability inventory: The skill uses a scoped SDK to make network requests to the RunAPI backend; it does not perform direct file system writes or shell command execution with user input.
- Sanitization: No explicit sanitization or validation of the prompt content is described within the skill instructions.
Audit Metadata