moda-video-footage

Pass

Audited by Gen Agent Trust Hub on Oct 16, 2026

Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data such as local video transcripts and canvas text nodes. Although the skill documentation includes explicit warnings to treat canvas content as data and not as instructions, an inherent attack surface for indirect prompt injection exists.
  • Ingestion points: Local footage ingested via moda rushes ingest and canvas data via moda canvas read.
  • Boundary markers: Explicit instructions are provided in references/reading-and-verifying.md to ignore directives embedded in canvas text.
  • Capability inventory: The skill utilizes moda rushes for file system access and moda file upload for network operations.
  • Sanitization: No automated sanitization is described, but the workflow emphasizes human review of the selection and final output.
  • [EXTERNAL_DOWNLOADS]: The skill uses the moda rushes install command to download and set up large-scale machine learning models (multi-GiB). This is documented as a standard initialization step for the vendor-provided toolkit.
  • [COMMAND_EXECUTION]: The skill makes extensive use of the authorized moda CLI tool via Bash to perform video indexing, analysis, and timeline management tasks.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 16, 2026, 07:42 AM