p-video
Pass
Audited by Gen Agent Trust Hub on Sep 2, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill uses the
Bashtool to executebeltCLI commands for model inference, such asbelt app run pruna/p-video.- [EXTERNAL_DOWNLOADS]: The skill references the installation of external components from theinference-shGitHub repository and theinference.shservice. It directs users to fetch installation instructions fromhttps://raw.githubusercontent.com/inference-sh/skills/refs/heads/main/cli-install.md.- [INDIRECT_PROMPT_INJECTION]: The skill exhibits a potential surface for command injection during the interpolation of user-supplied prompts into shell commands. - Ingestion points: User-provided strings for video prompts, images, or audio URLs are passed via the
--inputflag inSKILL.mdexamples. - Boundary markers: The examples use single quotes and JSON structures, but do not provide explicit instructions for the agent to escape shell metacharacters in user input.
- Capability inventory: The skill utilizes
Bash(belt *)which allows for arbitrary shell command execution within the scoped tool. - Sanitization: There is no evidence of automated sanitization or escaping of the user-provided prompt before it is interpolated into the
belt app runcommand string.
Audit Metadata