kling-video

Pass

Audited by Gen Agent Trust Hub on Sep 20, 2026

Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill includes a Python script that executes ffprobe and ffmpeg to validate generated video files. These calls are implemented securely using subprocess.Popen without a shell, and include execution timeouts and output size limits to prevent resource exhaustion.
  • [INDIRECT_PROMPT_INJECTION]: The skill processes user-supplied text prompts to generate video content via the Kling AI API. 1. Ingestion points: User prompts are ingested via the --prompt and --negative-prompt command-line arguments in the provided Python script and instructions in SKILL.md. 2. Boundary markers (present): Data is encapsulated within a structured JSON payload for transmission to the Kling AI API, providing logical separation between instructions and data. 3. Capability inventory: The skill utilizes network capabilities to communicate with the Kling AI API and performs file system operations to store generated videos and task metadata. It also executes media analysis tools (ffprobe, ffmpeg). 4. Sanitization (present): The script implements length validation (1..2500 characters) and size limits (10000 bytes) for prompts, and uses standard JSON libraries for safe serialization.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 20, 2026, 06:41 PM