ltx-2-video
Pass
Audited by Gen Agent Trust Hub on Sep 20, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The embedded Python script
ltx_hosted.pyinvokes local binariesffprobeandffmpegusingsubprocess.Popento perform technical validation of generated video files, including duration, resolution, frame rate, and codec integrity checks. The implementation prevents command injection by usingshell=Falseand passing arguments as a strictly defined list. - [EXTERNAL_DOWNLOADS]: The skill facilitates downloading video assets from the vendor's API (
api.ltx.video) and provides instructions for cloning the official model repository from GitHub and downloading model weights from Hugging Face. These activities are directed toward specific, well-known services and require explicit user approval for high-resource tasks. - [INDIRECT_PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection through user-supplied data.
- Ingestion points: User-provided strings via the
--promptargument and source video files for editing operations (SKILL.md). - Boundary markers: The skill provides structure for writing prompts but does not implement explicit delimiters to separate user content from the agent's internal instruction logic.
- Capability inventory: The skill possesses the ability to execute shell commands (
ffmpeg/ffprobe), perform network operations, and write to the local filesystem. - Sanitization: The Python script uses standard JSON encoding for API payloads and performs basic file integrity checks using media probes.
- [DYNAMIC_EXECUTION]: The utility script dynamically constructs and executes command-line calls to media processing tools at runtime to verify that output files meet the requested generation parameters.
Audit Metadata