video-stitch
Pass
Audited by Gen Agent Trust Hub on Jun 15, 2026
Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes the
meituCLI tool to perform video processing tasks. It constructs shell commands by interpolating user-provided inputs, such asvideo_listandmusic_url, directly into command-line arguments. - [PROMPT_INJECTION]: The skill exhibits a vulnerability surface for indirect prompt injection and command injection due to the lack of explicit sanitization for user-provided data used in shell execution.
- Ingestion points: The skill accepts
video_list,music_url, andpromptparameters from the user inSKILL.md. - Boundary markers: There are no defined boundary markers or instructions to ignore embedded commands within the interpolated parameters.
- Capability inventory: The skill has the capability to execute the
meitubinary and perform filesystem read/write operations in the~/.meitu/and workspace directories. - Sanitization: No sanitization, escaping, or validation logic for the input URLs or prompt strings is mentioned in the skill definition.
Audit Metadata