happy-horse-text-to-video
Pass
Audited by Gen Agent Trust Hub on Aug 12, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes user-supplied text prompts to generate video content, which creates a surface for potential indirect instruction injection.
- Ingestion points: The
scripts/videogen.pyscript accepts a--promptargument and file paths for media inputs in itsgeneratecommand. - Boundary markers: No specific delimiters are used; the prompt string is interpolated directly into the JSON request body.
- Capability inventory: The script performs network operations (POST/GET) to the AI Hive API and writes downloaded content to the local filesystem.
- Sanitization: Content is serialized as JSON, preventing primitive command injection into the HTTP request itself.
- [EXTERNAL_DOWNLOADS]: The skill automatically downloads generated video and image files from remote URLs provided by the API response during task polling.
- [COMMAND_EXECUTION]: The
initcommand withinvideogen.pyuses thewebbrowser.open()function to launch the user's default web browser to a specific vendor URL (https://ai-hive.iclip.cn/chat) for API key retrieval.
Audit Metadata