google-veo
Pass
Audited by Gen Agent Trust Hub on Aug 6, 2026
Risk Level: SAFE
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill references the installation of the
beltCLI and additional skill packages from thebelt-shandinference-shorganizations. These resources are necessary for the skill's primary function of video generation through the inference.sh API. - [COMMAND_EXECUTION]: The skill utilizes the
beltcommand-line utility to run video generation models. Execution is strictly scoped to thebeltbinary via theallowed-toolsfrontmatter configuration. - [PROMPT_INJECTION]: The skill takes user-provided prompts and interpolates them into JSON payloads for shell commands. This represents an indirect prompt injection surface.
- Ingestion points: User prompts in
SKILL.mdexamples. - Boundary markers: Commands use JSON structure within single quotes to delimit input.
- Capability inventory: Limited to the
beltCLI tool via Bash. - Sanitization: Relies on the
beltCLI's internal handling of JSON inputs.
Audit Metadata