ai-avatar-video
Pass
Audited by Gen Agent Trust Hub on Sep 14, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted external data via image and audio URLs which are passed to downstream AI models. Ingestion points: image_url, audio_url, reference_images, and reference_audio parameters defined in SKILL.md. Boundary markers: The skill utilizes a JSON-formatted string for the --input argument to isolate data from the bash command structure. Capability inventory: Execution of the runcomfy CLI tool via the Bash provider. Sanitization: The skill documentation does not specify any sanitization or validation of the content at the provided URLs.
- [EXTERNAL_DOWNLOADS]: The skill references the installation of the @runcomfy/cli Node.js package. This is a vendor-owned package consistent with the author's identity.
- [COMMAND_EXECUTION]: The skill provides command templates for the runcomfy CLI to facilitate its primary function of generating video content.
Audit Metadata