invideo-pipeline
Pass
Audited by Gen Agent Trust Hub on Nov 10, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to process external CSV data to generate batches of videos. This ingestion of untrusted data creates a surface for indirect prompt injection where malicious instructions within CSV fields could potentially influence the agent's behavior during the pipeline execution.
- Ingestion points: CSV sheets processed in the invideo-pipeline flow.
- Boundary markers: None explicitly defined to delimit data from instructions.
- Capability inventory: Shell command execution via the invideo CLI (e.g., status, auth login, register).
- Sanitization: No specific sanitization or validation logic is described for the CSV data before processing.
- [COMMAND_EXECUTION]: The skill relies on executing various commands using the invideo CLI tool to manage authentication, video generation status, and agent registration. While these are necessary for the skill's functionality, they involve shell-level operations.
Audit Metadata