minimax-h3-video
Pass
Audited by Gen Agent Trust Hub on Sep 20, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill orchestrates video generation by executing local orchestration scripts (
scripts/h3-cloud,scripts/h3-provision,scripts/h3-onboard) and standard media tools likeffprobe. These operations are central to the skill's primary purpose. - [SAFE]: The instructions implement strong security guardrails regarding sensitive data. The agent is explicitly forbidden from reading, printing, or requesting the user's API keys, directing them instead to use the official
compshare-clifor local profile management. - [INDIRECT_PROMPT_INJECTION]: The skill has an ingestion surface for untrusted data as it processes user-provided prompts and parameters (aspect ratio, duration) which are passed to backend scripts.
- Ingestion points: User prompts for video content, metadata strings for video parameters, and local image file paths provided via the chat interface.
- Boundary markers: The skill does not define explicit delimiters for input interpolation but uses a 'plan' and 'confirm' workflow to ensure the user reviews structural parameters before execution.
- Capability inventory: The skill possesses shell execution capabilities through the calling of its own orchestration scripts.
- Sanitization: While explicit character escaping is not detailed in the prompt instructions, the procedural logic requires the agent to parse inputs into specific structural parameters (e.g., converting '720P' to a specific Megapixel value) before command construction.
Audit Metadata