pixverse-ai-image-and-video-generator
Pass
Audited by Gen Agent Trust Hub on Oct 13, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill uses a Python script (
scripts/storyboard-media.py) and a PowerShell example (examples/windows/powershell-text-to-video.ps1) to handle local media tasks like splitting storyboard images and concatenating clips. These scripts interact with standard binaries (FFmpeg, ImageMagick) using secure argument lists for subprocess execution. - [EXTERNAL_DOWNLOADS]: The skill fetches updates and version info from the vendor's official GitHub repository (
PixVerseAI/skills) and references the standard NPM registry for CLI installation. These operations are conducted through well-known, trusted services associated with the skill author. - [INDIRECT_PROMPT_INJECTION]: The skill processes user-supplied prompts for media generation, creating an ingestion point for untrusted data.
- Ingestion points: Prompts are passed to commands in
capabilities/create-video.mdandcapabilities/create-and-edit-image.mdvia the--promptflag. - Boundary markers: Instructions recommend the use of quoted strings for parameters to separate user input from command flags.
- Capability inventory: The skill uses subprocess calls to media tools in
scripts/storyboard-media.pyand executes thepixverseCLI. - Sanitization: Standard shell quoting and agent-managed interpolation are used to mitigate injection risks during command construction.
Audit Metadata