ffmpeg-usage
Warn
Audited by Gen Agent Trust Hub on Aug 14, 2026
Risk Level: MEDIUMCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [PRIVILEGE_ESCALATION]: The skill's setup instructions include the use of
sudo apt-get install ffmpeg, which requires the agent to execute commands with elevated root privileges.\n- [INDIRECT_PROMPT_INJECTION]: The skill facilitates the construction of shell commands using user-provided inputs such as filenames, timestamps, and formatting parameters. This creates a surface for command injection if the agent does not properly escape shell metacharacters in strings sourced from untrusted user requests.\n - Ingestion points: Filenames, directory paths, and time-based parameters provided by the user in natural language.\n
- Boundary markers: Absent. The skill does not instruct the agent to use specific delimiters or quoting strategies to isolate user data from shell logic.\n
- Capability inventory: The skill leverages subprocess execution for
ffmpeg,printf, andrm. Notably, it suggests using the-safe 0flag with the concat demuxer, which disables safety checks for file paths and could allow path traversal or local file inclusion if the input list is maliciously crafted.\n - Sanitization: Absent. No logic is provided for validating or sanitizing user-controlled input before it is interpolated into shell command templates.
Audit Metadata