video-frames
Pass
Audited by Gen Agent Trust Hub on Oct 22, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The script
scripts/frame.shexecutes theffmpegcommand-line utility to perform video processing. This involves reading input video files, applying filters, and writing output images to the file system. - [INDIRECT_PROMPT_INJECTION]: The skill processes external video files and accepts user-controlled parameters that are passed into the
ffmpegcommand-line interface. - Ingestion points: File paths and extraction parameters (time and index) are passed as arguments to
scripts/frame.sh(e.g., inSKILL.mdusage examples). - Boundary markers: The skill does not implement specific boundary markers or "ignore previous instructions" warnings when handling potentially untrusted file paths provided by an agent's context.
- Capability inventory: The skill possesses the capability to create directories via
mkdir -p, read arbitrary files accessible to the user viaffmpeg, and write files to specified output paths. - Sanitization: The script includes basic validation to ensure the input file exists (
[[ ! -f "$in" ]]) and uses shell quoting for variables, but it lacks strict type or format validation for the--indexand--timeparameters, potentially allowing for tool-specific argument injection.
Audit Metadata