avatar-multi-scene
Pass
Audited by Gen Agent Trust Hub on Oct 2, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill provides shell command recipes for using
ffmpegto perform video concatenation and to create side-by-side comparison clips (SKILL.md, examples.md). - [EXTERNAL_DOWNLOADS]: The documentation guides the installation of several related skills from the PrunaAI organization using the
npx skills addcommand (SKILL.md, animate-beats.md). - [INDIRECT_PROMPT_INJECTION]:
- Ingestion points: User-provided inputs including
voice_script,video_prompt, and scene metadata in JSON format (SKILL.md, prompt-templates.md). - Boundary markers: Absent; there are no instructions to the agent to treat user-provided text as potentially untrusted or to ignore embedded instructions.
- Capability inventory: The skill uses shell execution for
ffmpegand network operations viacurlto interact with the Pruna API (SKILL.md). - Sanitization: The skill does not specify any validation or sanitization logic for user-provided strings before they are interpolated into API payloads or shell command arguments.
Audit Metadata