moda-video-footage
Pass
Audited by Gen Agent Trust Hub on Oct 16, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data such as local video transcripts and canvas text nodes. Although the skill documentation includes explicit warnings to treat canvas content as data and not as instructions, an inherent attack surface for indirect prompt injection exists.
- Ingestion points: Local footage ingested via
moda rushes ingestand canvas data viamoda canvas read. - Boundary markers: Explicit instructions are provided in
references/reading-and-verifying.mdto ignore directives embedded in canvas text. - Capability inventory: The skill utilizes
moda rushesfor file system access andmoda file uploadfor network operations. - Sanitization: No automated sanitization is described, but the workflow emphasizes human review of the selection and final output.
- [EXTERNAL_DOWNLOADS]: The skill uses the
moda rushes installcommand to download and set up large-scale machine learning models (multi-GiB). This is documented as a standard initialization step for the vendor-provided toolkit. - [COMMAND_EXECUTION]: The skill makes extensive use of the authorized
modaCLI tool via Bash to perform video indexing, analysis, and timeline management tasks.
Audit Metadata