create-video-seedance-2-fal
Pass
Audited by Gen Agent Trust Hub on Sep 28, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes user-supplied prompts and image URLs to generate video content. These inputs are passed to external APIs (FAL AI) through a proxy. While the skill includes moderation checks for NSFW content, the ingestion of untrusted data represents a potential surface for indirect prompt injection.\n
- Ingestion points: The
--promptand--image-urlarguments inscripts/generate.pyingest external content that is directly used to form the API request payload.\n - Boundary markers: The prompt template provides organizational structure with labels like
[SCENE 1]and[GLOBAL RULES], but it lacks strict isolation to prevent embedded instructions in the user-provided portions from affecting the agent's behavior.\n - Capability inventory: The skill has network access through the
requestslibrary to communicate with the FAL proxy and file-writing capabilities throughurllib.request.urlretrieveandpathlibto save the output video and metadata.\n - Sanitization: The skill relies on the downstream API's safety filters and includes logic in
scripts/generate.pyto identify and surfacecontent_policy_violationornsfwerrors, providing a basic level of safety handling for generated content.
Audit Metadata