local-media-transcription

Pass

Audited by Gen Agent Trust Hub on May 2, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill executes PowerShell commands to perform transcription and media analysis via whisper, ffmpeg, and ffprobe. These commands interpolate user-provided file paths, which could lead to command injection if the paths contain malicious shell metacharacters.
  • [EXTERNAL_DOWNLOADS]: The workflow reference recommends the installation of third-party Python packages whisperx and pyannote.audio via pip. These are standard, well-recognized libraries in the machine learning and transcription domains.
  • [PROMPT_INJECTION]: The skill possesses a surface for indirect prompt injection because it processes content from external media files to generate summaries and action items. Malicious instructions spoken in the audio could potentially influence the agent's behavior during the analysis phase.
  • Ingestion points: Local media files (MP4, MP3, WAV, etc.) processed in SKILL.md and transcription-workflow.md.
  • Boundary markers: Absent; the skill does not use specific delimiters or instructions to distinguish between the generated transcript and the agent's internal guidelines.
  • Capability inventory: Shell command execution via PowerShell for file inspection and transcription tool management.
  • Sanitization: There is no evidence of sanitization or filtering of the transcribed text before it is used by the agent for downstream summarization tasks.
Audit Metadata
Risk Level
SAFE
Analyzed
May 2, 2026, 09:24 AM