claude-video-transcode
Pass
Audited by Gen Agent Trust Hub on Sep 20, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [SAFE]: The skill implements standard video processing workflows using widely recognized tools like FFmpeg and FFprobe. The command templates provided for transcoding, compression, and container remuxing are technically sound and aligned with the skill's stated purpose. The use of temporary file cleanup in /tmp is appropriate for the context of two-pass encoding.\n- [INDIRECT_PROMPT_INJECTION]: The skill possesses a data ingestion surface by processing external media files, which represents an entry point for potential indirect prompt injection via malformed or crafted metadata.\n
- Ingestion points: External video files are ingested as "$INPUT" and analyzed using
ffprobeor processed byffmpeg.\n - Boundary markers: No explicit instructions are provided to the agent to treat metadata as untrusted or to use specific delimiters when processing these files.\n
- Capability inventory: The skill uses the
Bashtool to executeffmpeg,ffprobe, and maintenance commands such asrm.\n - Sanitization: The skill relies on the inherent security of the media processing binaries; no specific prompt-level sanitization or validation of the input metadata is defined in the instructions.\n- [COMMAND_EXECUTION]: The skill uses the
Bashtool to perform its primary functions. This includes environment detection scripts (e.g.,detect_gpu.sh), file analysis withffprobe, and transcoding operations withffmpeg. All commands are restricted to the domain of video processing and local file management relevant to the task.
Audit Metadata