create-video-veo3

Pass

Audited by Gen Agent Trust Hub on Aug 19, 2026

Risk Level: SAFEPROMPT_INJECTIONEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
  • [PROMPT_INJECTION]: The skill documentation includes an 'inverse-fallback' strategy that instructs the agent to switch to the veo3_1_lite model if other models' content filters are triggered. This is explicitly described as a way to use a model with different moderation thresholds to circumvent initial rejections.
  • [EXTERNAL_DOWNLOADS]: The skill downloads generated MP4 video files from Higgsfield and FAL CDNs. These operations are performed using curl via the CLI or the download method in the generate-fal.py script. These network requests are required to retrieve the generated content for the user.
  • [COMMAND_EXECUTION]: Provides instructions for the agent to use the Higgsfield CLI (/opt/homebrew/bin/higgsfield) as a primary fallback mechanism. This includes commands for video generation, media management, and job polling.
  • [INDIRECT_PROMPT_INJECTION]: The skill processes user-supplied briefs to create generative model prompts. Ingestion points: User briefs in the workflow. Boundary markers: Use of build_animation_prompt.py to structure the output. Capability inventory: File system writes and network API calls to external services. Sanitization: Prompt structural enforcement is used to mitigate potential injection within the brief text.
  • [DYNAMIC_EXECUTION]: The generate-fal.py script uses sys.path.insert to dynamically include and load helper modules from a shared directory within the skill's repository structure.
Audit Metadata
Risk Level
SAFE
Analyzed
Aug 19, 2026, 04:39 PM
Security Audit — agent-trust-hub — create-video-veo3