novoads-image-to-motion
Pass
Audited by Gen Agent Trust Hub on Aug 13, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill utilizes local shell scripts (
./scripts/check-novoads-env.sh,./scripts/setup.sh, and./scripts/test-parity-i2m.sh) to verify environment variables, perform initial setup, and execute parity tests. These scripts are part of the skill's internal logic for environment validation. - [DATA_EXPOSURE]: The skill manages the
NOVOADS_API_KEYby reading it from a local.envfile. It includes explicit instructions to avoid printing secrets to logs or committing them to version control, which aligns with standard security best practices for secret management. - [EXTERNAL_DOWNLOADS]: The skill performs authenticated network requests (POST, GET, PUT) to the official vendor API domain
api.novoads.ai. These operations are used for pricing estimates, image uploads, and retrieving generated video content, which are the primary intended functions of the skill. - [INDIRECT_PROMPT_INJECTION]: The skill processes user-provided images and text to build prompts for a downstream video generation model. It mitigates potential instruction leakage or unintended behavior by employing structured prompt templates with clearly defined boundary markers (e.g., 'CAMERA:', 'TEXT:', 'TIMED BEATS:') and instructing the agent to transcribe text verbatim into quoted strings.
Audit Metadata