miora-video-studio
Pass
Audited by Gen Agent Trust Hub on Sep 18, 2026
Risk Level: SAFECOMMAND_EXECUTIONDATA_EXFILTRATIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill uses shell commands to run a bundled Python script
scripts/miora_watch.pyfor monitoring file system events and verifying the integrity of generated video files using binary metadata parsing. - [DATA_EXFILTRATION]: The skill reads internal configuration files such as
~/.workbuddy/mcp.jsonand~/.workbuddy/mcp-approvals.json, and job metadata from the user's home directory. These actions are intended to diagnose the status of the local video generation environment and track job history. - [INDIRECT_PROMPT_INJECTION]: The skill possesses a vulnerability surface where instructions in data could potentially influence the agent.
- Ingestion points: User-provided text prompts for video generation and file metadata read from
~/.workbuddy/plugins/data/mcp-miora/miora-media. - Boundary markers: The instructions do not define strict delimiters or "ignore" instructions for the data being processed.
- Capability inventory: Execution of bundled Python scripts via shell commands and calls to the
mcp__miora__*toolset. - Sanitization: Employs regex validation (
^[\w.-]+$) for job names to prevent basic command injection, but does not sanitize general prompt content.
Audit Metadata