video-shortform
Pass
Audited by Gen Agent Trust Hub on Jun 28, 2026
Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill instructs the agent to execute a shell command
node "$OD_BIN" media generateto process video generation tasks. This command relies on environment variables and interpolates project metadata and user-provided prompts as arguments. - [PROMPT_INJECTION]: The skill possesses an indirect prompt injection surface (Category 8) because it accepts user-controlled strings and inserts them into a command-line execution context without specifying sanitization or escaping measures. \n
- Ingestion points: Project metadata (videoModel, videoAspect) and the user-provided video prompt (SKILL.md). \n
- Boundary markers: Arguments are wrapped in double quotes in the provided bash template, but there are no instructions to escape shell-active characters within the prompt string. \n
- Capability inventory: Subprocess execution of the platform's media generation CLI tool (SKILL.md). \n
- Sanitization: No input validation or escaping logic is defined for the prompt before it is passed to the shell command.
Audit Metadata