ai-video-generation
Pass
Audited by Gen Agent Trust Hub on Sep 12, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill references and provides instructions to install official tools from the vendor's GitHub repository (github.com/magichourhq/magic-hour-mcp) and connects to an MCP server hosted at mcp.magichour.ai. These are recognized vendor resources associated with the skill author.
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted user inputs such as prompts, images, and audio to generate video content, which is inherent to its primary purpose.
- Ingestion points: User-provided prompts, images, audio, and performance descriptions are ingested into the generation pipeline via the SKILL.md instructions.
- Boundary markers: No explicit delimiter or 'ignore embedded instructions' markers are defined in the instructions for these inputs.
- Capability inventory: The skill performs network operations to the vendor's MCP server (mcp.magichour.ai) and downloads completed video files to durable local paths.
- Sanitization: The instructions do not define specific sanitization or validation steps for external content beyond manual inspection of the 'first frame' for visual anomalies.
- [SAFE_PRACTICES]: The skill includes explicit security guidelines, instructing the agent never to request API keys in chat and to avoid including credentials, signed URLs, or private upload paths in project files. It also requires verifying a spending limit before initiating paid operations.
Audit Metadata