reel
Pass
Audited by Gen Agent Trust Hub on Apr 3, 2026
Risk Level: SAFEPROMPT_INJECTION
Full Analysis
- [PROMPT_INJECTION]: The skill incorporates untrusted user input from $ARGUMENTS into its output generation and file-saving logic without adequate safeguards. • Ingestion points: User input enters via $ARGUMENTS and is used in the reel script and the output filename. • Boundary markers: The prompt lacks delimiters or specific instructions to ignore malicious commands embedded in the user input. • Capability inventory: The skill creates directories and writes HTML files with inline JavaScript to the local filesystem. • Sanitization: No validation or escaping is specified for user input used in filenames or the resulting HTML file, which could lead to path traversal or XSS if not mitigated by the execution environment.
Audit Metadata