video-qa

Fail

Audited by Gen Agent Trust Hub on Aug 15, 2026

Risk Level: HIGHEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
  • [REMOTE_CODE_EXECUTION]: The skill includes instructions to install Homebrew by executing its official installation script from https://raw.githubusercontent.com/Homebrew/install/HEAD/install.sh via a shell command. It also suggests installing ffmpeg through various system package managers such as apt, dnf, winget, and choco.
  • [COMMAND_EXECUTION]: The skill directs the agent to perform command-line operations for processing video files, specifically using ffmpeg for multi-frame extraction and qlmanage for generating thumbnails. It also references the use of sudo for package management, which is contextually appropriate for the tool's installation instructions.
  • [PROMPT_INJECTION]: The skill exhibits an indirect prompt injection surface by ingesting and processing untrusted project data to perform its quality assurance tasks.
  • Ingestion points: The skill reads external files such as shot-list.md, generation-log.md, and character/environment/prop bibles.
  • Boundary markers: The instructions lack specific delimiters or safety warnings for the agent to distinguish between data and instructions within these files.
  • Capability inventory: The agent has the ability to read local files, execute shell commands (e.g., ffmpeg), and provide generated prompts to other specialist agents.
  • Sanitization: No input validation or content sanitization is described for the processed data files.
Recommendations
  • HIGH: Downloads and executes remote code from: https://raw.githubusercontent.com/Homebrew/install/HEAD/install.sh - DO NOT USE without thorough review
Audit Metadata
Risk Level
HIGH
Analyzed
Aug 15, 2026, 07:14 AM