archive-broll

Pass

Audited by Gen Agent Trust Hub on Oct 28, 2026

Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
  • [INDIRECT_PROMPT_INJECTION]: The skill retrieves and processes metadata and media files from the Internet Archive (archive.org), which is a platform for user-contributed content.
  • Ingestion points: The scripts/archive-broll.mjs script fetches JSON metadata and video file URLs from the archive.org API.
  • Boundary markers: The data is handled as structured JSON fields and media streams; no specific instruction-filtering delimiters are present, but the data is not passed back into an LLM prompt as text.
  • Capability inventory: The skill uses spawnSync to execute ffmpeg and ffprobe for video processing and fs.writeFileSync to save files to the local system.
  • Sanitization: The implementation follows security best practices by using array-based subprocess execution (preventing shell injection) and strictly constructing download URLs using encodeURIComponent to ensure they point only to the official archive.org domain.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 28, 2026, 01:45 AM