runway-media
Pass
Audited by Gen Agent Trust Hub on Oct 12, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [SAFE]: The skill interacts with the official Runway MCP server at mcp.runwayml.com. All operations, including image and video generation, editing, and account management, use authenticated vendor-owned tools.
- [COMMAND_EXECUTION]: The skill mentions that the Runway MCP server provides curl commands for file uploads. This is a standard and expected functionality for uploading media to the Runway platform.
- [INDIRECT_PROMPT_INJECTION]: The skill accepts user-provided prompts and URLs for media generation. It provides a safety guideline instructing the agent not to use local filesystem paths as URLs. Ingestion points: User-provided text prompts and public HTTPS URLs. Boundary markers: None. Capability inventory: Media generation tools and network upload via curl. Sanitization: Instructions to avoid using local file paths as URLs.
Audit Metadata