scenario-reel-recast
Pass
Audited by Gen Agent Trust Hub on Oct 17, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted external data in the form of user-provided video and image references (
referenceVideos,referenceImages). This creates an attack surface where an attacker could embed malicious instructions within video frames or character sheets. The skill mitigates this by providing explicit instructional boundaries to the agent, such as 'Take nothing else from @image1: no panels, labels or text' and 'only the dress: nothing of the mannequin, the background, the logos or any text', ensuring the AI ignores non-visual metadata or text. - [COMMAND_EXECUTION]: The skill references the use of standard command-line tools such as
ffmpegfor local asset verification andnpxfor installing necessary sibling skills from the vendor's repository (scenario-labs/skills). These commands are part of the intended developer workflow and are limited to the vendor's own ecosystem and standard media processing utilities.
Audit Metadata