revid-api-foundations
Pass
Audited by Gen Agent Trust Hub on Oct 28, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill defines workflows (such as article-to-video and script-to-video) that ingest and process untrusted data from external URLs or user-provided text, which may contain malicious instructions.
- Ingestion points: External data is ingested through fields like
source.urlandsource.textwithin therender_videotool definition in SKILL.md. - Boundary markers: The foundation does not specify the use of delimiters or specific boundary markers to separate untrusted external content from the prompt context during API interpolation.
- Capability inventory: The skill possesses network capabilities to communicate with external endpoints (
https://www.revid.ai/api/mcpandhttps://www.revid.ai/api/public/v3/render) via MCP tools or HTTPS fallbacks. - Sanitization: There is no mention of sanitization, filtering, or validation of the ingested external content before it is processed by the rendering engine.
Audit Metadata