Skills
Navigate
skills/modeltc/lightx2v-skills/lightx2v-ai-video-generation/Gen Agent Trust Hub

lightx2v-ai-video-generation

Fail

Audited by Gen Agent Trust Hub on Sep 24, 2026

Risk Level: HIGHREMOTE_CODE_EXECUTIONINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
  • [REMOTE_CODE_EXECUTION]: Fetches the CLI installation script from the vendor's official GitHub repository and executes it via the shell.
  • Evidence: curl -fsSL https://raw.githubusercontent.com/ModelTC/lightx2v-studio-cli/main/install.sh | sh in SKILL.md.
  • [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data that is subsequently processed by AI models, creating a potential vector for indirect prompt injection.
  • Ingestion points: Text prompts, image URLs, and audio files provided as arguments to the lightx2v CLI in SKILL.md and references/workflow-nodes.md.
  • Boundary markers: No specific boundary markers or instructions to ignore embedded commands were found in the prompt templates.
  • Capability inventory: The skill possesses the capability to execute shell commands (lightx2v), perform network requests to the vendor's API, and write files to the local system (e.g., -o portrait.png).
  • Sanitization: No explicit sanitization or validation of the content of user-provided media or prompts was identified.
  • [COMMAND_EXECUTION]: The skill is designed to execute commands using the vendor's lightx2v CLI tool to perform video generation and management tasks.
  • Evidence: The allowed-tools list in SKILL.md restricts execution to Bash(lightx2v *) commands.
Recommendations
  • HIGH: Downloads and executes remote code from: https://raw.githubusercontent.com/ModelTC/lightx2v-studio-cli/main/install.sh - DO NOT USE without thorough review
Audit Metadata
Risk Level
HIGH
Analyzed
Sep 24, 2026, 01:36 AM