create-video-veo3
Pass
Audited by Gen Agent Trust Hub on Aug 19, 2026
Risk Level: SAFEPROMPT_INJECTIONEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [PROMPT_INJECTION]: The skill documentation includes an 'inverse-fallback' strategy that instructs the agent to switch to the
veo3_1_litemodel if other models' content filters are triggered. This is explicitly described as a way to use a model with different moderation thresholds to circumvent initial rejections. - [EXTERNAL_DOWNLOADS]: The skill downloads generated MP4 video files from Higgsfield and FAL CDNs. These operations are performed using
curlvia the CLI or thedownloadmethod in thegenerate-fal.pyscript. These network requests are required to retrieve the generated content for the user. - [COMMAND_EXECUTION]: Provides instructions for the agent to use the Higgsfield CLI (
/opt/homebrew/bin/higgsfield) as a primary fallback mechanism. This includes commands for video generation, media management, and job polling. - [INDIRECT_PROMPT_INJECTION]: The skill processes user-supplied briefs to create generative model prompts. Ingestion points: User briefs in the workflow. Boundary markers: Use of
build_animation_prompt.pyto structure the output. Capability inventory: File system writes and network API calls to external services. Sanitization: Prompt structural enforcement is used to mitigate potential injection within the brief text. - [DYNAMIC_EXECUTION]: The
generate-fal.pyscript usessys.path.insertto dynamically include and load helper modules from a shared directory within the skill's repository structure.
Audit Metadata