modellix

Pass

Audited by Gen Agent Trust Hub on Sep 9, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill includes logic in scripts/cli_runtime.py to check the version of modellix-cli and automatically update it from the official NPM registry (registry.npmjs.org). This is a documented feature to ensure the agent uses the latest vendor-provided tools for media generation tasks.
  • [COMMAND_EXECUTION]: The Python scripts preflight.py and invoke_and_poll.py utilize subprocess.run to orchestrate the environment and execute tasks. These commands are restricted to standard system tools (like npm and node) and the vendor's own CLI (modellix-cli) for diagnosing connectivity, submitting tasks, and downloading generated assets.
  • [INDIRECT_PROMPT_INJECTION]: As the skill's primary purpose is to interface with AI models, it ingests user-supplied prompts and media URLs. These inputs are passed to the Modellix API for processing. The skill includes clear documentation and playbook rules to handle these inputs through official CLI and REST channels.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 9, 2026, 06:12 AM
Security Audit — agent-trust-hub — modellix