best-video-editor-for-beginners
Pass
Audited by Gen Agent Trust Hub on Sep 19, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill performs network requests to an external API hosted at
mega-api-prod.nemovideo.ai. This communication is used for anonymous authentication, session creation, real-time message processing (SSE), file uploads, and video rendering/export. - [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted user content and processes responses from an external backend agent, creating a potential surface for indirect prompt injection.
- Ingestion points: User text queries about editing goals, local video files provided by the user, and external video URLs (SKILL.md §3.2).
- Boundary markers: The instructions do not define specific delimiters or warnings to ignore embedded instructions within the ingested data.
- Capability inventory: The skill possesses the ability to perform authenticated network operations (POST, GET) to a third-party API and execute operations based on the backend's response.
- Sanitization: No explicit sanitization or validation of user-provided content or external file data is mentioned before it is processed by the backend services.
Audit Metadata