video-artifact-intake
Pass
Audited by Gen Agent Trust Hub on Jun 16, 2026
Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill invokes
ffprobeto extract video metadata such as duration, dimensions, and codecs. This is a legitimate use of the tool for video analysis. - [COMMAND_EXECUTION]: The skill executes local Node.js scripts (
scripts/harness/video-intake.tsand./.video-evaluator/agent/run-tool.mjs) to perform its primary logic. These scripts are part of the skill's own package or the target repository. - [PROMPT_INJECTION]: Indirect Prompt Injection Surface: The skill reads and processes external JSON artifacts produced by the repository which could theoretically contain instructions to influence agent behavior.
- Ingestion points: Local files such as
quality.json,verification.json,latest.json, andtimeline.evidence.jsonas specified inSKILL.md. - Boundary markers: None identified in the documentation.
- Capability inventory: Local file system reads and metadata extraction via subprocesses (
ffprobe). - Sanitization: No explicit sanitization or validation of the content within these JSON reports is described.
Audit Metadata