video-i2i
Pass
Audited by Gen Agent Trust Hub on Sep 26, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill instructions suggest running
uvx videoclaw, which downloads and executes thevideoclawpackage from a remote registry (PyPI) at runtime. This package is not from a pre-defined trusted organization. - [INDIRECT_PROMPT_INJECTION]: The skill processes user-provided images which could potentially contain adversarial patterns designed to influence the behavior of the AI model.
- Ingestion points: Path to input images provided via the
-ior--inputparameter in thevideoclaw i2icommand (SKILL.md). - Boundary markers: None identified; instructions do not specify delimiters for distinguishing data from commands during image processing.
- Capability inventory: The skill executes shell commands using
videoclawto transform images and save them to the local filesystem (-oparameter). - Sanitization: No evidence of input validation or sanitization for the image files or prompt strings before they are passed to the CLI tool.
- [COMMAND_EXECUTION]: The skill facilitates the execution of local shell commands through the
videoclawCLI tool to perform image processing tasks.
Audit Metadata