adobe-edit-quick-cut
Pass
Audited by Gen Agent Trust Hub on Oct 24, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- Indirect Prompt Injection Surface: The skill is designed to ingest and process user-provided video files to create highlight reels. This processing is a central feature of the skill.
- Ingestion points: User-uploaded video files are identified as the primary data input in SKILL.md.
- Boundary markers: The skill employs structured tool calls (video_create_quick_cut) with specific parameters, which serves to isolate the media content from the agent's instructional logic.
- Capability inventory: The skill utilizes tools for file staging, video creation, and status polling, along with command-line utilities (curl) for asset management as documented in SKILL.md.
- Sanitization: User selections for video style and duration are mapped to a fixed set of hardcoded internal prompts in SKILL.md (Step 5), preventing direct user-controlled text from being passed into the editing tool's style parameters.
- External Asset Downloads: In environments where specific UI widgets are unavailable, the skill instructions guide the agent to download generated video variations from the service provider's infrastructure using standard command-line tools. These downloads are restricted to the media files produced during the editing workflow.
- File System and Command Execution: The skill interacts with the local environment to stage files and manage downloads, particularly as a fallback for non-UI interfaces. These operations are scoped to the user-data directories and the assets necessary for the video editing task.
Audit Metadata