capcut-ai-video-editor
Pass
Audited by Gen Agent Trust Hub on Sep 19, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSDATA_EXFILTRATIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [DATA_EXFILTRATION]: The skill is configured to upload local video files and metadata to the external API at
https://mega-api-prod.nemovideo.ai/api/upload-video/. Although essential for the skill's purpose, this behavior involves transmitting user data to a third-party service provider. - [INDIRECT_PROMPT_INJECTION]: The skill processes Server-Sent Events (SSE) from the remote backend and maps specific text commands to agent actions (e.g., "Export button" triggers the export workflow). This creates an attack surface where a compromised backend could control the agent's behavior.
- Ingestion points: Local file data for upload and the SSE response stream from the backend.
- Boundary markers: The skill does not implement boundary markers or instructions to differentiate data from executable commands within the backend's response.
- Capability inventory: Includes network operations (POST/GET), file read access for media uploads, and management of authentication tokens.
- Sanitization: No validation or sanitization is performed on instructions received from the remote API.
- [EXTERNAL_DOWNLOADS]: The skill retrieves authentication tokens and session states from the non-whitelisted domain
nemovideo.ai.
Audit Metadata