fix-my-look
Pass
Audited by Gen Agent Trust Hub on Jun 18, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill fetches video content from external URLs provided by the user and downloads generated media to the local ~/Downloads/ directory.
- [COMMAND_EXECUTION]: The workflow involves executing various MCP tools provided by the Pika-Labs plugin (mcp__plugin_pika_pika__*) to perform asset normalization, media generation, and file management.
- [PROMPT_INJECTION]: The skill has an indirect prompt injection surface because it interpolates user-provided text prompts (change_prompt) and external video content into instructions for downstream AI models. -- Ingestion points: User-supplied <change_prompt> and video assets (SKILL.md). -- Boundary markers: None; the prompt is directly inserted into the instructions for the image and video generation tools. -- Capability inventory: Uses MCP tools for network uploads, media processing, and writing results to the local filesystem. -- Sanitization: There is no evidence of sanitization or validation for the user-provided text or media content before it is processed.
Audit Metadata