qinghu-video-audio-extract

Pass

Audited by Gen Agent Trust Hub on Sep 21, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill instructs the user or agent to install the @iqinghu/qhkit package from the npm registry. It also suggests the use of the npmmirror.com registry, which is a well-known service providing a mirror of the official npm registry.
  • [COMMAND_EXECUTION]: The skill utilizes the ffmpeg CLI tool for local audio extraction and the qhkit CLI for processing remote video links. These are standard tools for the stated purpose of the skill.
  • [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted external data in the form of video files and URLs provided by the user.
  • Ingestion points: Video URLs from social platforms and local video file paths.
  • Boundary markers: None present in the instructions.
  • Capability inventory: Includes shell command execution via ffmpeg and qhkit, file system writes for the output MP3/WAV files, and network access to fetch video content.
  • Sanitization: None explicitly defined; the skill relies on the agent's safe execution of shell commands.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 21, 2026, 04:09 PM