jimeng-api-video-gen
Pass
Audited by Gen Agent Trust Hub on Oct 1, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill accepts and processes untrusted user-supplied data (text prompts and image URLs) which are then reflected back into the agent's context, creating a potential surface for indirect prompt injection.
- Ingestion points: The
scripts/generate_video.pyscript takes a mandatorypromptargument and optional--imageand--tail-imageURL parameters which are populated from user input. - Boundary markers: The skill does not implement explicit delimiters or boundary markers in its output instructions to the agent to isolate the reflected user content.
- Capability inventory: The skill has network access capabilities via the
requestslibrary and file system write access through the--outputcommand-line option inscripts/generate_video.py. - Sanitization: No sanitization, escaping, or validation is performed on the input prompt or image URLs before they are transmitted to the external API or displayed in the final output report.
Audit Metadata