omniflash-restyle
Pass
Audited by Gen Agent Trust Hub on Oct 5, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTIONDATA_EXFILTRATION
Full Analysis
- [COMMAND_EXECUTION]: The skill provides numerous templates for executing
ffmpegandffprobecommands to process video files locally. - Evidence includes commands for audio extraction (
ffmpeg -i raw.mp4 -vn -c:a aac), tonemapping (ffmpeg -i in.mp4 -vf zscale...), video chunking (ffmpeg -ss {in} -t {dur} -c:v libx264), and final assembly. - [INDIRECT_PROMPT_INJECTION]: The skill processes user-supplied scripts and tool-generated transcripts, which are interpolated into prompts for the generative video model.
- Ingestion points: Raw video footage, user scripts, and word-level transcripts (from
arcads_transcribe) are used as primary inputs in Phases A and C. - Boundary markers: Prompt templates use quotation marks for text overlays, but the skill lacks specific delimiters or "ignore previous instructions" warnings to prevent script content from influencing model behavior.
- Capability inventory: The skill has access to file-system operations (via
ffmpeg), network uploads, and generative AI tool calls (arcads_generate_video_omni_flash). - Sanitization: The instructions emphasize verification of spelling and timing but do not describe programmatic sanitization or escaping of input data before prompt construction.
- [DYNAMIC_EXECUTION]: The skill generates shell command strings for
ffmpegfrom templates at runtime, including the creation of a local file list to facilitate video concatenation. - [DATA_EXFILTRATION]: The workflow involves uploading video and image assets to the vendor's storage infrastructure via
arcads_get_upload_urlandarcads_register_video.
Audit Metadata