ltx-2-video

Pass

Audited by Gen Agent Trust Hub on Sep 20, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
  • [COMMAND_EXECUTION]: The embedded Python script ltx_hosted.py invokes local binaries ffprobe and ffmpeg using subprocess.Popen to perform technical validation of generated video files, including duration, resolution, frame rate, and codec integrity checks. The implementation prevents command injection by using shell=False and passing arguments as a strictly defined list.
  • [EXTERNAL_DOWNLOADS]: The skill facilitates downloading video assets from the vendor's API (api.ltx.video) and provides instructions for cloning the official model repository from GitHub and downloading model weights from Hugging Face. These activities are directed toward specific, well-known services and require explicit user approval for high-resource tasks.
  • [INDIRECT_PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection through user-supplied data.
  • Ingestion points: User-provided strings via the --prompt argument and source video files for editing operations (SKILL.md).
  • Boundary markers: The skill provides structure for writing prompts but does not implement explicit delimiters to separate user content from the agent's internal instruction logic.
  • Capability inventory: The skill possesses the ability to execute shell commands (ffmpeg/ffprobe), perform network operations, and write to the local filesystem.
  • Sanitization: The Python script uses standard JSON encoding for API payloads and performs basic file integrity checks using media probes.
  • [DYNAMIC_EXECUTION]: The utility script dynamically constructs and executes command-line calls to media processing tools at runtime to verify that output files meet the requested generation parameters.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 20, 2026, 06:41 PM