runway-debug-bundle

Pass

Audited by Gen Agent Trust Hub on Oct 23, 2026

Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [INDIRECT_PROMPT_INJECTION]: The skill implements a pattern for generating video content based on a prompt_text parameter in SKILL.md.
  • Ingestion points: The prompt_text field used in the client.image_to_video.create method call.
  • Boundary markers: None are specified to delimit or warn the agent about potentially malicious instructions embedded in the prompt data.
  • Capability inventory: The skill utilizes the runwayml SDK and has broad environment access via Read, Write, Edit, Bash, and Grep tools.
  • Sanitization: There is no evidence of sanitization, filtering, or validation for the input prompt before it is sent to the AI model.
  • [EXTERNAL_DOWNLOADS]: The skill identifies the official Runway Python SDK repository on GitHub (github.com/runwayml/sdk-python) as a primary resource for implementation.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 23, 2026, 04:42 PM