moda-video-clip
Pass
Audited by Gen Agent Trust Hub on Sep 8, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted user descriptions and external brand metadata into generation prompts and CLI commands without the use of boundary markers or sanitization logic.
- Ingestion points: User prompts provided via argument hints and brand asset metadata retrieved via the
moda brand showcommand are interpolated into video generation tasks. - Boundary markers: No explicit delimiters or instructions to ignore embedded commands are present in the provided templates.
- Capability inventory: The skill utilizes
Bash(moda:*)which provides extensive file system access, network operations for media fetching, and canvas manipulation. - Sanitization: There is no evidence of input validation or sanitization before data is passed to tool calls.
- [DYNAMIC_EXECUTION]: The skill utilizes a JavaScript-based batch editor to manipulate canvas objects at runtime.
- Evidence: As detailed in
references/edit-code.md, themoda canvas editcommand executes synchronous JavaScript code to mutate existing nodes and pages. This behavior is inherent to the primary purpose of the skill.
Audit Metadata