contact-sheet

Pass

Audited by Gen Agent Trust Hub on Oct 4, 2026

Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill facilitates the execution of a local Ruby script (lib/buttercut/contact_sheet.rb) which utilizes ffmpeg to process video clips. This is a standard functional requirement for media processing tasks within the skill's context.
  • [INDIRECT_PROMPT_INJECTION]: The skill exposes an attack surface by accepting external inputs such as video file paths, start times, and end times, which are passed as arguments to the Ruby execution script.
  • Ingestion points: User-supplied <video-path>, <start>, and <end> parameters in SKILL.md.
  • Boundary markers: No explicit prompt boundary markers or instruction-ignoring warnings are present in the provided markdown instructions.
  • Capability inventory: The skill performs local file system reads and script execution via Ruby and ffmpeg.
  • Sanitization: The provided markdown documentation does not specify the sanitization or validation logic implemented within the Ruby script for the provided arguments.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 4, 2026, 03:05 PM