best-ai-video-editor-free
Pass
Audited by Gen Agent Trust Hub on Sep 19, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONDATA_EXFILTRATIONEXTERNAL_DOWNLOADS
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill acts as a bridge between user-supplied media and a cloud processing API, which introduces a surface for indirect prompt injection if the processed content contains malicious instructions.
- Ingestion points: User messages provided to the SSE stream and video files uploaded via multipart forms (SKILL.md, Sections 3.1 and 3.2).
- Boundary markers: The instructions do not include specific delimiters or prompts to the agent to ignore instructions potentially embedded within the media metadata or transcripts.
- Capability inventory: The skill possesses the ability to perform network operations (POST/GET) to external API endpoints for session state management and media rendering.
- Sanitization: There is no explicit requirement for the agent to sanitize or validate external content before it is interpolated into API requests.
- [DATA_EXFILTRATION]: The skill performs network operations to
https://mega-api-prod.nemovideo.aifor authentication, session creation, and task execution. This includes transmitting metadata about the agent's installation environment via theX-Skill-Platformheader. - [EXTERNAL_DOWNLOADS]: The skill facilitates the retrieval of processed video and image files from a remote proxy server (
https://mega-api-prod.nemovideo.ai/api/render/proxy/lambda) upon project completion.
Audit Metadata