video-generation
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill executes a local Python script (
/mnt/skills/public/video-generation/scripts/generate.py) to process video generation requests. This script serves as a bridge between the agent and external AI generation services. - [EXTERNAL_DOWNLOADS]: The script performs network operations to
generativelanguage.googleapis.com(Google Gemini) andapi.minimaxi.com(MiniMax). These are well-known and official API endpoints for AI video generation. The script also downloads generated media files from URLs provided by these services. - [DATA_EXPOSURE_EXFILTRATION]: The skill correctly handles sensitive API keys (
GEMINI_API_KEY,MINIMAX_API_KEY) by reading them from environment variables rather than hardcoding them or requiring them in user prompts, adhering to standard security practices. - [PROMPT_INJECTION]: The instructions include directives such as "Do NOT read the python file" and "You don't need to check the folder under /mnt/user-data". While these constrain the agent's typical recursive inspection, they appear to be intended for performance optimization or to prevent unnecessary filesystem overhead during routine tasks, as the underlying code and file operations are benign.
Audit Metadata