image-to-video
Pass
Audited by Gen Agent Trust Hub on Oct 18, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes external binaries (ffmpeg and ffprobe) to perform its primary function of video creation. The implementation in scripts/image_to_video.py utilizes subprocess.run with list-based arguments, which is a secure method that prevents shell injection vulnerabilities.
- [INDIRECT_PROMPT_INJECTION]: The skill exposes an attack surface where the agent processes external data. 1. Ingestion points: The agent reads the output of ffprobe and the script scripts/image_to_video.py as described in SKILL.md. 2. Boundary markers: Instructions in SKILL.md tell the agent to look for specific duration, size, and codec metadata. 3. Capability inventory: The skill has access to Bash, Read, Write, Grep, Glob, and Edit tools as defined in the SKILL.md frontmatter. 4. Sanitization: Handled by external binaries; no direct sanitization of tool output before agent processing.
Audit Metadata