contact-sheet
Pass
Audited by Gen Agent Trust Hub on Oct 4, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill facilitates the execution of a local Ruby script (
lib/buttercut/contact_sheet.rb) which utilizesffmpegto process video clips. This is a standard functional requirement for media processing tasks within the skill's context. - [INDIRECT_PROMPT_INJECTION]: The skill exposes an attack surface by accepting external inputs such as video file paths, start times, and end times, which are passed as arguments to the Ruby execution script.
- Ingestion points: User-supplied
<video-path>,<start>, and<end>parameters inSKILL.md. - Boundary markers: No explicit prompt boundary markers or instruction-ignoring warnings are present in the provided markdown instructions.
- Capability inventory: The skill performs local file system reads and script execution via Ruby and
ffmpeg. - Sanitization: The provided markdown documentation does not specify the sanitization or validation logic implemented within the Ruby script for the provided arguments.
Audit Metadata