create-anime-lifehack

Warn

Audited by Gen Agent Trust Hub on Feb 17, 2026

Risk Level: MEDIUMEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
  • [Indirect Prompt Injection] (MEDIUM): The skill processes user-provided topics to generate scripts and AI prompts without implementing boundary markers or sanitization of the narrative content.
  • Ingestion points: SKILL.md Step 1 accepts raw user input for the video topic.
  • Boundary markers: Absent; the prompt generation logic lacks delimiters or 'ignore embedded instructions' directives.
  • Capability inventory: The skill interacts with the fal.ai API and executes local ffmpeg commands via shell scripts.
  • Sanitization: While scripts/fal.ts sanitizes filenames, it does not sanitize or escape the content interpolated into the AI prompts.
  • [External Downloads] (LOW): The skill installs Node.js dependencies via npm install and instructs users to download system binaries like ffmpeg. These are from standard repositories.
  • [Command Execution] (LOW): The skill executes a local shell script (combine-scenes.sh) to merge video files and uses npx tsx to run its internal TypeScript logic. These operations are limited to the skill's local directory and standard media processing.
Audit Metadata
Risk Level
MEDIUM
Analyzed
Feb 17, 2026, 08:01 AM