p-video
Pass
Audited by Gen Agent Trust Hub on Apr 22, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill references external installation scripts and documentation hosted on official vendor domains including inference.sh and GitHub. These references are consistent with the skill's purpose and provided by the recognized author.
- [PROMPT_INJECTION]: The skill possesses a vulnerability surface for indirect prompt injection due to the processing of untrusted user input. 1. Ingestion points: Prompts, image URLs, and audio URLs are passed as arguments to the infsh tool. 2. Boundary markers: Input data is encapsulated within JSON objects, providing a logical separation between command logic and user data. 3. Capability inventory: Execution is limited to the infsh command within the Bash environment as specified in the skill's allowed-tools. 4. Sanitization: No explicit validation or escaping of user-supplied prompt text or media URLs is performed before they are interpolated into the command line arguments.
Audit Metadata