claude-video-transcode

Pass

Audited by Gen Agent Trust Hub on Sep 20, 2026

Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
  • [SAFE]: The skill implements standard video processing workflows using widely recognized tools like FFmpeg and FFprobe. The command templates provided for transcoding, compression, and container remuxing are technically sound and aligned with the skill's stated purpose. The use of temporary file cleanup in /tmp is appropriate for the context of two-pass encoding.\n- [INDIRECT_PROMPT_INJECTION]: The skill possesses a data ingestion surface by processing external media files, which represents an entry point for potential indirect prompt injection via malformed or crafted metadata.\n
  • Ingestion points: External video files are ingested as "$INPUT" and analyzed using ffprobe or processed by ffmpeg.\n
  • Boundary markers: No explicit instructions are provided to the agent to treat metadata as untrusted or to use specific delimiters when processing these files.\n
  • Capability inventory: The skill uses the Bash tool to execute ffmpeg, ffprobe, and maintenance commands such as rm.\n
  • Sanitization: The skill relies on the inherent security of the media processing binaries; no specific prompt-level sanitization or validation of the input metadata is defined in the instructions.\n- [COMMAND_EXECUTION]: The skill uses the Bash tool to perform its primary functions. This includes environment detection scripts (e.g., detect_gpu.sh), file analysis with ffprobe, and transcoding operations with ffmpeg. All commands are restricted to the domain of video processing and local file management relevant to the task.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 20, 2026, 02:27 AM
Security Audit — agent-trust-hub — claude-video-transcode