revid-pdf-to-video

Pass

Audited by Gen Agent Trust Hub on Oct 28, 2026

Risk Level: SAFEINDIRECT_PROMPT_INJECTIONDATA_EXFILTRATIONCOMMAND_EXECUTION
Full Analysis
  • [SAFE]: The skill implements a standard integration with the Revid video generation service.
  • [SAFE]: Sensitive information (REVID_API_KEY) is managed via configuration and environment variables rather than being hardcoded within the skill instructions or scripts.
  • [COMMAND_EXECUTION]: The skill provides an example bash script (examples/run.sh) that uses standard system utilities (curl, jq) to perform API requests. This script is transparent and used for demonstration purposes.
  • [DATA_EXFILTRATION]: The skill performs network operations to the Revid API (revid.ai) to transmit the PDF URL and receive project status. This is the core functionality of the skill and uses the user-provided API key for authentication.
  • [INDIRECT_PROMPT_INJECTION]: The skill processes content from external PDF URLs, which constitutes an indirect prompt injection surface where instructions embedded in the source PDF could potentially influence the AI-generated video summary.
  • Ingestion points: PDF content fetched from the provided url parameter in SKILL.md and examples/whitepaper.json.
  • Boundary markers: No explicit delimiters or system instructions are defined to separate the extracted PDF content from the summarization instructions.
  • Capability inventory: The skill calls the render_video tool which interfaces with a third-party generation service.
  • Sanitization: No specific sanitization or filtering of the PDF text is performed prior to the summarization step.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 28, 2026, 08:04 PM