ai-avatar-video
Pass
Audited by Gen Agent Trust Hub on May 5, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: Provides references to installation scripts and documentation hosted on the vendor's GitHub repository.
- [COMMAND_EXECUTION]: Instructs users to use the
infshcommand-line tool for logging into the service and executing video generation models. - [PROMPT_INJECTION]: The skill exposes an attack surface for indirect prompt injection as it processes user-supplied media URLs for image and audio input.
- Ingestion points: Media URLs (
image_url,audio_url,video_url) provided in tool inputs inSKILL.md. - Boundary markers: None present to delineate untrusted URL content.
- Capability inventory: Shell execution capabilities via the
infshtool. - Sanitization: No sanitization of user-provided URLs is performed before execution.
Audit Metadata