create-video-seedance
Pass
Audited by Gen Agent Trust Hub on Aug 19, 2026
Risk Level: SAFEPROMPT_INJECTIONEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted user-provided video briefs to generate instructions for AI video models. This constitutes a surface for indirect prompt injection. * Ingestion points: User-supplied brief in SKILL.md input parameters. * Boundary markers: The skill uses a shared prompt-building script but lacks explicit delimiters for user content. * Capability inventory: Network access (upload/download via Higgsfield and FAL) and file system access (writing MP4 and manifest files). * Sanitization: Employs a prompt sanitizer to detect sensitive keywords and routing issues.
- [UNVERIFIABLE_DEPENDENCIES_AND_REMOTE_CODE_EXECUTION]: The skill downloads generated video content from Higgsfield and FAL-AI services. These operations are essential to the skill's function and target well-known service providers.
- [DYNAMIC_EXECUTION]: The workflow involves executing a local Python script, scripts/generate-fal.py, to interact with the FAL-AI API as a fallback mechanism. This script is invoked with parameters derived from the user request.
Audit Metadata