video-studio

Pass

Audited by Gen Agent Trust Hub on Aug 18, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill documentation instructs the user to run a local installation script ./install.sh and utilizes a rendering engine called render.py. These scripts are used to manage system environments and execute the final video composite.
  • [EXTERNAL_DOWNLOADS]: The setup process relies on several well-known external tools and services, including ffmpeg, Node.js, Google Chrome, and the ElevenLabs API. These dependencies are standard for the skill's stated purpose of video and audio processing.
  • [PROMPT_INJECTION]: The skill processes video transcripts to determine edit points, creating a potential surface for indirect prompt injection where malicious instructions could be embedded in the footage.
  • Ingestion points: The agent reads video transcripts and timeline images during the 'Transcribe + pack' stage.
  • Boundary markers: The instructions do not define specific delimiters or instructions to ignore embedded commands within the transcripts.
  • Capability inventory: The skill has the capability to write project metadata, generate EDL files, and execute subprocesses for video rendering.
  • Sanitization: There is no mention of filtering, escaping, or validating the transcript text before it is processed by the LLM.
Audit Metadata
Risk Level
SAFE
Analyzed
Aug 18, 2026, 04:10 PM
Security Audit — agent-trust-hub — video-studio