video-qa
Fail
Audited by Gen Agent Trust Hub on Jul 20, 2026
Risk Level: HIGHEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill instructs the user to download the ffmpeg utility from its official website and fetches the official Homebrew installation script from its public repository.
- [REMOTE_CODE_EXECUTION]: Provides standard command-line instructions for installing Homebrew and ffmpeg on the user's system, including the execution of a remote shell script from a well-known source to set up the package manager.
- [COMMAND_EXECUTION]: The skill provides numerous shell commands and batch loops for media processing using tools like ffmpeg, qlmanage, and system package managers such as brew, apt, dnf, and winget.
- [PROMPT_INJECTION]: The skill exhibits an indirect prompt injection surface based on how it processes project data.
- Ingestion points: Processes project metadata files such as shot-list.md and generation-log.md, and parses video filenames (shot_*.mp4) provided by the user.
- Boundary markers: The instructions do not define explicit delimiters or 'ignore' instructions for the content of the processed files.
- Capability inventory: The skill facilitates directory creation, report writing to the local filesystem, and execution of system commands for media processing.
- Sanitization: Input data from filenames and markdown content are not explicitly sanitized before being incorporated into shell commands or used for logic decisions.
Recommendations
- HIGH: Downloads and executes remote code from: https://raw.githubusercontent.com/Homebrew/install/HEAD/install.sh - DO NOT USE without thorough review
Audit Metadata