video-init
Pass
Audited by Gen Agent Trust Hub on Sep 26, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes shell commands using the
videoclawCLI to initialize directories and set configuration values (videoclaw initandvideoclaw config). These actions are performed to set up the project environment as requested by the user. - [INDIRECT_PROMPT_INJECTION]: The skill captures a project name from the user and interpolates it into a shell command (
videoclaw init <project-name>). This represents a potential command injection surface if the input is not sanitized by the underlying agent platform. - Ingestion points: Project name collected via
AskUserQuestioninSKILL.md. - Boundary markers: No explicit delimiters or instructions are provided to the agent to sanitize or escape the project name.
- Capability inventory: Shell command execution via the
videoclawutility as seen inSKILL.md. - Sanitization: No specific sanitization logic is defined within the skill instructions.
Audit Metadata