magic-hour-image-to-video
Pass
Audited by Gen Agent Trust Hub on Nov 5, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes user-supplied creative briefs and product descriptions to generate motion prompts for AI video synthesis. This creates a potential attack surface where instructions hidden within user input could attempt to influence the agent's behavior beyond the intended scope.
- Ingestion points: Creative briefs, product metadata, and image descriptions provided during the 'Define the shot' phase in SKILL.md.
- Boundary markers: The instructions provide structure for the agent to 'Extract or infer' specific parameters, but do not mandate explicit delimiters or escaping for the user-supplied content.
- Capability inventory: The skill utilizes capabilities including network-based file uploads (HTTPS PUT), API interactions with video generation tools (create_video_from_image, edit_image), and file system reads/writes for project notes.
- Sanitization: No explicit sanitization or validation of the input text is mandated before interpolation into motion prompts.
Audit Metadata