video-quick-create
Pass
Audited by Gen Agent Trust Hub on Sep 26, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes the
videoclaw i2vshell command in Step 4 to generate the video. This command relies on several parameters, including project paths and text content, which are derived from earlier AI-generated steps. - [INDIRECT_PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because untrusted data from user inputs is processed by the AI and then used in a sensitive execution context.
- Ingestion points: User input for the video idea in Step 1 is the primary source of untrusted data.
- Boundary markers: The skill lacks explicit boundary markers or instructions to the LLM to sanitize the generated storyboard content for shell safety.
- Capability inventory: The skill has the capability to execute shell commands (
videoclaw) and write files to the local file system within the<project>directory. - Sanitization: No sanitization or escaping mechanisms are described for the
<文本分镜内容>variable before its interpolation into the shell command in Step 4. - [DYNAMIC_EXECUTION]: The shell command for video synthesis is dynamically assembled at runtime, incorporating string values generated by the AI model during the storyboard phase.
Audit Metadata