runway-dev-recipes
Pass
Audited by Gen Agent Trust Hub on Oct 30, 2026
Risk Level: SAFE
Full Analysis
- [DATA_EXPOSURE]: The skill includes explicit security instructions to keep project API secrets on the server and prevents them from being exposed in browsers, chat sessions, source control, or MCP configurations.
- [INDIRECT_PROMPT_INJECTION]: The skill identifies the risk of external documentation containing malicious instructions and provides a defensive prompt instructing the agent to treat fetched documentation only as reference data, not as a source for commands or permission changes.
- [EXTERNAL_DOWNLOADS]: The skill references documentation and workflow indices hosted on the official runwayml.com domain, which is the vendor's own infrastructure.
Audit Metadata