video-qa

Fail

Audited by Gen Agent Trust Hub on Jul 20, 2026

Risk Level: HIGHEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill instructs the user to download the ffmpeg utility from its official website and fetches the official Homebrew installation script from its public repository.
  • [REMOTE_CODE_EXECUTION]: Provides standard command-line instructions for installing Homebrew and ffmpeg on the user's system, including the execution of a remote shell script from a well-known source to set up the package manager.
  • [COMMAND_EXECUTION]: The skill provides numerous shell commands and batch loops for media processing using tools like ffmpeg, qlmanage, and system package managers such as brew, apt, dnf, and winget.
  • [PROMPT_INJECTION]: The skill exhibits an indirect prompt injection surface based on how it processes project data.
  • Ingestion points: Processes project metadata files such as shot-list.md and generation-log.md, and parses video filenames (shot_*.mp4) provided by the user.
  • Boundary markers: The instructions do not define explicit delimiters or 'ignore' instructions for the content of the processed files.
  • Capability inventory: The skill facilitates directory creation, report writing to the local filesystem, and execution of system commands for media processing.
  • Sanitization: Input data from filenames and markdown content are not explicitly sanitized before being incorporated into shell commands or used for logic decisions.
Recommendations
  • HIGH: Downloads and executes remote code from: https://raw.githubusercontent.com/Homebrew/install/HEAD/install.sh - DO NOT USE without thorough review
Audit Metadata
Risk Level
HIGH
Analyzed
Jul 20, 2026, 10:20 PM