collage-broll-explainers
Warn
Audited by Gen Agent Trust Hub on Jul 20, 2026
Risk Level: MEDIUMCOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill utilizes ffmpeg and ffprobe for video processing, which are executed locally on the user's machine.
- [COMMAND_EXECUTION]: Shell commands are constructed dynamically using variables like and . This creates a potential command injection surface if the agent platform does not sanitize user-provided project titles before including them in shell command paths.
- [EXTERNAL_DOWNLOADS]: The skill connects to the MaxFusion MCP (https://mcp.maxfusion.ai/mcp) for generating images and videos.
- [PROMPT_INJECTION]: The skill provides an indirect prompt injection surface by incorporating user-supplied text into AI prompts without sanitization. Evidence: Ingestion points: user scripts; Capability inventory: shell execution, network access; Boundary markers: none; Sanitization: none.
Audit Metadata