revid-blog-to-avatar-video
Pass
Audited by Gen Agent Trust Hub on Oct 28, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill includes a shell script (
examples/run.sh) that utilizescurlandjqto interact with the Revid API for rendering and status polling. This is provided as a smoke test for the direct HTTPS integration. - [INDIRECT_PROMPT_INJECTION]: The skill processes content from external blog URLs provided by the user, which presents a surface where instructions embedded in the blog text could attempt to influence the agent's summarization or video generation process.
- Ingestion points: The
urlparameter in therender_videotool and the script input inexamples/run.sh. - Boundary markers: The instructions do not define specific delimiters for the external content within the agent's context.
- Capability inventory: The skill calls MCP tools (
render_video,get_project_status,create_character) and performs network requests viacurlto the Revid API. - Sanitization: There is no explicit sanitization or filtering of the external blog content defined in the skill instructions.
Audit Metadata