rw-generate-video
Fail
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: HIGHREMOTE_CODE_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [REMOTE_CODE_EXECUTION]: The skill provides instructions to install the 'uv' project manager using its official script (curl -LsSf https://astral.sh/uv/install.sh | sh). This pattern downloads and executes code from the well-known astral.sh service.
- [INDIRECT_PROMPT_INJECTION]: The skill ingests data from external URLs, creating a vulnerability surface where malicious content within the media files could potentially influence agent behavior.
- Ingestion points: Remote media URLs passed to the '--image-url' and '--video-url' parameters in SKILL.md.
- Boundary markers: Absent.
- Capability inventory: Use of the 'Bash' tool to execute 'uv run' and the 'Write' tool to save generated content.
- Sanitization: Absent.
Recommendations
- HIGH: Downloads and executes remote code from: https://astral.sh/uv/install.sh - DO NOT USE without thorough review
Audit Metadata