linkpix-video-audio-extract
Pass
Audited by Gen Agent Trust Hub on Sep 21, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPRIVILEGE_ESCALATIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill instructions involve executing shell commands for media processing and tool management, which provides a surface for command injection if inputs are not properly escaped by the agent.
- [EXTERNAL_DOWNLOADS]: The skill downloads the ffmpeg binary via system package managers and the @iqinghu/qhkit library from the public NPM registry.
- [PRIVILEGE_ESCALATION]: The recommended installation commands for system-level dependencies (e.g., apt-get install) require elevated privileges to modify the host environment.
- [INDIRECT_PROMPT_INJECTION]: (1) Ingestion points: Video metadata and scripts are retrieved from external platform links via the qhkit tool. (2) Boundary markers: The skill does not define clear boundaries or markers to isolate potentially untrusted external content. (3) Capability inventory: The skill has access to shell command execution (ffmpeg, qhkit) and file system operations. (4) Sanitization: There is no evidence of sanitization or safety checks performed on data fetched from external sources before it is processed or presented.
Audit Metadata