anime-match

Pass

Audited by Gen Agent Trust Hub on Jun 26, 2026

Risk Level: SAFE
Full Analysis
  • [COMMAND_EXECUTION]: The skill utilizes command-line tools like ffmpeg (via edit_concat) to stitch generated video clips into a final production. This is an expected and documented functionality for a video-centric skill.
  • [PROMPT_INJECTION]: The skill interpolates user-provided data such as the hero's name, team kit colors, and opponent descriptions directly into prompts for image and video generation.
  • Ingestion points: User-supplied photo URL, hero name, and team/opponent descriptions in SKILL.md (Stage 0).
  • Boundary markers: None present; user input is directly formatted into the prompt templates.
  • Capability inventory: Accesses generate_image, generate_reference_video, and edit_concat tools.
  • Sanitization: No sanitization or validation of the input strings is performed before interpolation.
  • Note: While this presents a surface for indirect prompt injection, the risk is minimal as the output is confined to media generation and does not influence logical agent decisions or system state.
  • [EXTERNAL_DOWNLOADS]: The skill references specific external providers (nano-banana-pro and seedance) for media generation. These are standard components within the vendor's documented workflow and are used for their intended creative purposes.
Audit Metadata
Risk Level
SAFE
Analyzed
Jun 26, 2026, 06:40 PM
Security Audit — agent-trust-hub — anime-match