video-extend
Pass
Audited by Gen Agent Trust Hub on Jul 13, 2026
Risk Level: SAFEPROMPT_INJECTION
Full Analysis
- [PROMPT_INJECTION]: Potential for indirect prompt injection through processing of untrusted external content.
- Ingestion points: The skill accepts a
video_urlandpromptwhich may originate from untrusted third-party data sources in complex agent workflows. - Boundary markers: Input data is encapsulated within a JSON structure passed to the CLI via the
--inputargument, effectively delimiting user-controlled content from the command execution context. - Capability inventory: The skill is restricted to the
Bash(runcomfy *)tool, which allows network interaction with vendor-controlled domains and local file system writes to specified output directories. - Sanitization: Instructions specify that the CLI avoids shell expansion for prompt content, providing a layer of protection against command injection within the tool parameters.
Audit Metadata