video-edit
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill uses the
@runcomfy/clicommand-line tool to execute video editing tasks by routing user requests to specified AI models via theruncomfy runcommand.\n- [INDIRECT_PROMPT_INJECTION]: The skill is designed to process user-provided prompts and media URLs, which serves as a surface for indirect prompt injection.\n - Ingestion points: The skill ingests
prompt,video,reference_image,image, andvideo_urlparameters within the routing logic defined inSKILL.md.\n - Boundary markers: The skill includes a dedicated 'Security & Privacy' section that explicitly warns users to treat external media URLs as untrusted due to potential injection risks.\n
- Capability inventory: The skill relies on the local
runcomfyCLI to submit video processing jobs to remote APIs and download the results.\n - Sanitization: The skill documentation specifies that the CLI handles input as a JSON string via the
--inputflag to prevent shell expansion vulnerabilities.
Audit Metadata