video-t2i
Pass
Audited by Gen Agent Trust Hub on Sep 26, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill accepts user-provided text through the
--promptparameter and passes it directly to thevideoclawcommand-line tool. This creates a potential vulnerability where specially crafted input could influence command execution. - Ingestion points:
SKILL.md(via command-line arguments in examples). - Boundary markers: No delimiters or sanitization instructions are used for the user-supplied prompt text.
- Capability inventory: Executes the
videoclawCLI tool via shell. - Sanitization: None observed; the skill relies on the agent's default shell handling.
- [COMMAND_EXECUTION]: The skill instructions utilize the
videoclawCLI tool to perform its primary function. This requires the ability to execute external commands and pass user-defined arguments to them.
Audit Metadata