runway
Pass
Audited by Gen Agent Trust Hub on Aug 7, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill uses the Zapier Connectors SDK to securely interface with the Runway API (api.dev.runwayml.com). All network requests are targeted at this official service domain.
- [SAFE]: Sensitive credentials (API keys) are managed through environment variables or Zapier's secure connection infrastructure, avoiding hardcoded secrets or unsafe exposure.
- [SAFE]: The skill relies on standard, well-known Node.js dependencies for its operation, and the included CLI wrapper is used for environment preparation and task dispatching within the local execution context.
- [SAFE]: Analysis of the media generation tools confirms they implement proper input validation using Zod schemas to ensure data integrity before processing.
- [PROMPT_INJECTION]: The skill ingests user-provided text prompts and external asset URLs which are processed by downstream generative models. This inherent attack surface for indirect prompt injection is mitigated by the use of Zod for input schema validation and the security controls of the target service.
Audit Metadata