magic-hour-talking-video
Pass
Audited by Gen Agent Trust Hub on Sep 12, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes user-supplied scripts for voice generation, creating an opportunity for malicious instructions to be embedded in the content.\n
- Ingestion points: Ingests user-provided text scripts and media file paths (
SKILL.md).\n - Boundary markers: The skill lacks delimiters or instructions to ignore embedded prompts; instructions specifically require the agent to preserve the "exact script."\n
- Capability inventory: Performs network operations via the Magic Hour API (job creation, status retrieval) and reads local media files for upload (
SKILL.md).\n - Sanitization: The instructions do not specify any validation or sanitization for the user-provided text content.\n- [EXTERNAL_DOWNLOADS]: The skill references setup documentation and API schemas from the vendor's official GitHub repository and documentation site.\n
- Evidence: References to
https://github.com/magichourhq/magic-hour-mcp/blob/main/user.mdandhttps://docs.magichour.ai/api-reference/openapi.jsonfor configuration and reference.
Audit Metadata