ai-video-generation
Pass
Audited by Gen Agent Trust Hub on Oct 30, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted user-supplied media (images, video, audio) and fetches external data through the
saved_items_listtool. This creates a potential attack surface for indirect prompt injection via embedded metadata or content. The skill provides some mitigation by instructing the agent to keep internal project records and asset paths private. - [EXTERNAL_DOWNLOADS]: The skill references the official Magic Hour MCP server and installation guides hosted on the vendor's official domains (
magichour.ai) and GitHub repositories (github.com/magichourhq). These represent standard vendor functionality and configuration procedures.
Audit Metadata