explainer-video-guide
Pass
Audited by Gen Agent Trust Hub on Apr 14, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSPROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill references external resources including installation guides and additional skill modules hosted by the inference-sh organization.
- [COMMAND_EXECUTION]: Provides instructions to execute CLI commands ('infsh') and package manager commands ('npx') to manage the video production pipeline and install dependencies.
- [PROMPT_INJECTION]: The skill processes untrusted user input for media generation prompts (such as scene descriptions and voiceover scripts) and interpolates them into CLI commands without sanitization or boundary markers, creating a surface for indirect prompt injection.
- Ingestion points: User-defined prompts for scene visuals and text-to-speech generation in SKILL.md.
- Boundary markers: No delimiters or instructions to ignore embedded commands are present in the provided templates.
- Capability inventory: Execution of remote media applications and file merging via the 'infsh' CLI (authorized via Bash tool).
- Sanitization: No evidence of input validation or escaping logic for user-supplied strings.
Audit Metadata