claude-video-analyze
Pass
Audited by Gen Agent Trust Hub on May 15, 2026
Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill provides numerous Bash command recipes for
ffprobeandffmpegto inspect video properties. It includes a multi-step script for testing Constant Rate Factor (CRF) values, which writes temporary video files and results to/tmp/before removing them. - [PROMPT_INJECTION]: The skill contains a directive stating that operations are "safe to auto-execute without confirmation," which encourages the agent to skip standard user verification for shell commands. Additionally, the skill demonstrates a surface for indirect prompt injection via user-provided filenames.
- Ingestion points: User-provided file paths assigned to the
$INPUTvariable inSKILL.md. - Boundary markers: None identified.
- Capability inventory: Uses the
Bashtool for shell execution. - Sanitization: No explicit escaping or validation of the
$INPUTvariable is present. - [SAFE]: The external utilities referenced (
ffmpeg,ffprobe,scenedetect) are standard industry tools for video processing, and their usage here aligns with the skill's stated purpose.
Audit Metadata