Skills
skills/curiositech/some_claude_skills/ai-video-production-master/Gen Agent Trust Hub

ai-video-production-master

Fail

Audited by Gen Agent Trust Hub on Mar 6, 2026

Risk Level: HIGHREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONEXTERNAL_DOWNLOADSCREDENTIALS_UNSAFE
Full Analysis
  • [REMOTE_CODE_EXECUTION]: The script scripts/cloud_i2v_batch.py generates and executes an onstart bash script on remote Vast.ai cloud instances to install packages (comfy-cli, httpx) and download large binary models.
  • [COMMAND_EXECUTION]: Multiple scripts utilize subprocess.run to call system tools: scripts/cloud_i2v_batch.py executes vastai, ssh, and scp; scripts/motion_graphics_generator.py executes ffmpeg, rsvg-convert, and convert (ImageMagick).
  • [CREDENTIALS_UNSAFE]: The script scripts/cloud_i2v_batch.py accesses local SSH private keys from sensitive paths including ~/.ssh/id_ed25519_vastai and default locations (~/.ssh/id_rsa) to automate cloud orchestration.
  • [EXTERNAL_DOWNLOADS]: The skill automatically fetches AI models and text encoders from Hugging Face (huggingface.co) during the remote instance setup process.
  • [INDIRECT_PROMPT_INJECTION]: The skill processes user-controlled data (JSON chart data, images, motion prompts) while possessing command execution and network capabilities. 1. Ingestion points: Found in scripts/motion_graphics_generator.py and scripts/cloud_i2v_batch.py. 2. Boundary markers: Absent. 3. Capability inventory: Shell command execution via subprocess and network access via httpx. 4. Sanitization: No validation or sanitization of external inputs was identified.
Recommendations
  • AI detected serious security threats
Audit Metadata
Risk Level
HIGH
Analyzed
Mar 6, 2026, 01:10 PM