Skills
Navigate
skills/tmakersas/revid-skills/revid-script-with-custom-media/Gen Agent Trust Hub

revid-script-with-custom-media

Pass

Audited by Gen Agent Trust Hub on Oct 28, 2026

Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
  • [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process user-provided scripts and media URLs, which could potentially contain malicious instructions or metadata.
  • Ingestion points: Untrusted data enters via the text and media.provided[] input fields in SKILL.md.
  • Boundary markers: There are no explicit instructions to use delimiters or ignore embedded instructions within the processed data fields.
  • Capability inventory: The skill has access to MCP tools such as render_video, get_project_status, and export_video to interact with an external service.
  • Sanitization: The instructions include basic validation of media URLs for HTTP 200 responses but do not define any content-level sanitization or escaping mechanisms.
  • [COMMAND_EXECUTION]: The skill provides a functional bash script (examples/run.sh) intended for smoke testing the direct API fallback.
  • The script uses curl to perform network operations against the official service domain www.revid.ai.
  • It utilizes environment variables for secret management, which is a standard and recommended practice.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 28, 2026, 08:04 PM