revid-pdf-to-video
Pass
Audited by Gen Agent Trust Hub on Oct 28, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONDATA_EXFILTRATIONCOMMAND_EXECUTION
Full Analysis
- [SAFE]: The skill implements a standard integration with the Revid video generation service.
- [SAFE]: Sensitive information (REVID_API_KEY) is managed via configuration and environment variables rather than being hardcoded within the skill instructions or scripts.
- [COMMAND_EXECUTION]: The skill provides an example bash script (
examples/run.sh) that uses standard system utilities (curl,jq) to perform API requests. This script is transparent and used for demonstration purposes. - [DATA_EXFILTRATION]: The skill performs network operations to the Revid API (
revid.ai) to transmit the PDF URL and receive project status. This is the core functionality of the skill and uses the user-provided API key for authentication. - [INDIRECT_PROMPT_INJECTION]: The skill processes content from external PDF URLs, which constitutes an indirect prompt injection surface where instructions embedded in the source PDF could potentially influence the AI-generated video summary.
- Ingestion points: PDF content fetched from the provided
urlparameter inSKILL.mdandexamples/whitepaper.json. - Boundary markers: No explicit delimiters or system instructions are defined to separate the extracted PDF content from the summarization instructions.
- Capability inventory: The skill calls the
render_videotool which interfaces with a third-party generation service. - Sanitization: No specific sanitization or filtering of the PDF text is performed prior to the summarization step.
Audit Metadata