ltx2
Pass
Audited by Gen Agent Trust Hub on Sep 13, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [SAFE]: The skill follows security best practices for secret management by instructing users to store endpoint URLs in
.envfiles and use specific platform secret managers (Modal secrets) for API tokens rather than hardcoding them in scripts or instructions. - [INDIRECT_PROMPT_INJECTION]: The skill takes user-provided text as input for video generation prompts. While this is an entry point for untrusted data, the skill's capabilities are restricted to video generation, limiting the potential impact of malicious inputs.
- Ingestion points: User-provided strings via the
--promptargument intools/ltx2.py. - Boundary markers: None explicitly defined in the CLI command usage.
- Capability inventory: Executes the local Python script
tools/ltx2.py, which performs network requests to a configured Modal endpoint. - Sanitization: Not explicitly documented in the instruction file, though the impact is confined to the AI generation process.
Audit Metadata