create-product-demo-video
Pass
Audited by Gen Agent Trust Hub on Jul 10, 2026
Risk Level: SAFEPROMPT_INJECTIONDATA_EXFILTRATIONCOMMAND_EXECUTION
Full Analysis
- [PROMPT_INJECTION]: The skill ingests untrusted text via the
briefandscriptinputs which are used to draft voiceover scripts and generate prompts for video generation tools. This represents a potential surface for indirect prompt injection.\n - Ingestion points:
briefandscriptinputs in Phase 1 of the workflow.\n - Boundary markers: Not present; the instructions do not specify the use of delimiters when interpolating user data into drafting prompts.\n
- Capability inventory: File system access within the project directory, network API communication with external generative services, and execution of local validation scripts.\n
- Sanitization: No explicit sanitization or input validation logic is described for the input brief.\n- [DATA_EXFILTRATION]: The skill sends generated scripts and audio content to ElevenLabs and FAL for processing. While these are reputable services required for the skill's operation, the transmission of data to external endpoints is noted as a standard operation.\n- [COMMAND_EXECUTION]: Automated quality checks and verification steps (as described in
tests/verifier.md) utilizepython3,ffprobe, andgrep. These commands are executed to validate the integrity and metadata of locally generated project files.
Audit Metadata