runway-sdk-patterns
Pass
Audited by Gen Agent Trust Hub on Sep 9, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill integrates with the Runway ML API and accepts user-provided prompts for video generation, which represents an ingestion surface for untrusted data.
- Ingestion points: User-defined
prompt_textin the SDK example code inSKILL.md. - Boundary markers: None provided in the implementation snippet to delimit instructions from data.
- Capability inventory: The skill allows
Bash(pip:*),Read, andWritetools. - Sanitization: No explicit sanitization or validation of the prompt content is shown in the pattern.
- [EXTERNAL_DOWNLOADS]: The skill contains references to official developer resources for the Runway ML platform.
- Evidence: Links point to the official
runwaymlGitHub repository and documentation site.
Audit Metadata