dream-to-video
Pass
Audited by Gen Agent Trust Hub on Oct 9, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill requires the agent to execute multiple shell commands to clone the repository, install Python dependencies, install the Playwright browser, and manage the application lifecycle.
- [EXTERNAL_DOWNLOADS]: The skill downloads the project source code from the vendor's GitHub repository at
https://github.com/mediastormDev/dream-to-video-skill.gitand fetches the Chromium browser via Playwright. - [REMOTE_CODE_EXECUTION]: The agent is instructed to run the downloaded Python scripts (
main.py) for login, status checking, and starting a background worker process that handles video generation and post-processing. - [INDIRECT_PROMPT_INJECTION]: The skill processes user-supplied dream descriptions and interpolates them into video generation prompts.
- Ingestion points: User-provided text素材, diary fragments, or oral dream descriptions (SKILL.md).
- Boundary markers: The instructions provide a specific template and technical base for the prompt, but do not define explicit delimiters or sanitization for the user's input.
- Capability inventory: The skill can execute shell commands (
main.py worker), write files to the localoutput/directory, and interact with the filesystem. - Sanitization: The instructions focus on transforming the content into a specific cinematic style rather than sanitizing for malicious injection patterns.
Audit Metadata