kling-video
Pass
Audited by Gen Agent Trust Hub on Sep 20, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill includes a Python script that executes
ffprobeandffmpegto validate generated video files. These calls are implemented securely usingsubprocess.Popenwithout a shell, and include execution timeouts and output size limits to prevent resource exhaustion. - [INDIRECT_PROMPT_INJECTION]: The skill processes user-supplied text prompts to generate video content via the Kling AI API. 1. Ingestion points: User prompts are ingested via the
--promptand--negative-promptcommand-line arguments in the provided Python script and instructions in SKILL.md. 2. Boundary markers (present): Data is encapsulated within a structured JSON payload for transmission to the Kling AI API, providing logical separation between instructions and data. 3. Capability inventory: The skill utilizes network capabilities to communicate with the Kling AI API and performs file system operations to store generated videos and task metadata. It also executes media analysis tools (ffprobe, ffmpeg). 4. Sanitization (present): The script implements length validation (1..2500 characters) and size limits (10000 bytes) for prompts, and uses standard JSON libraries for safe serialization.
Audit Metadata