ai-multimodal
Warn
Audited by Gen Agent Trust Hub on Oct 9, 2026
Risk Level: MEDIUMDYNAMIC_EXECUTIONCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [DYNAMIC_EXECUTION]: The script 'scripts/media_optimizer.py' uses the 'eval()' function to process frame rate strings produced by 'ffprobe'. This is a security risk as a specifically crafted media file could potentially influence the command output to execute arbitrary Python code.
- [COMMAND_EXECUTION]: The skill relies on 'subprocess.run' to execute 'ffmpeg' and 'ffprobe' for media optimization tasks. This provides an execution path for external tools that process untrusted binary data.
- [INDIRECT_PROMPT_INJECTION]: The skill has a significant attack surface as it ingests untrusted data from PDFs, images, and videos via 'gemini_batch_process.py' and 'document_converter.py'. It lacks explicit boundary markers or sanitization to prevent the LLM from following instructions embedded within these media files. Capability inventory includes shell command execution and file system writes.
Audit Metadata