videoediting

Pass

Audited by Gen Agent Trust Hub on Oct 3, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTIONDATA_EXFILTRATION
Full Analysis
  • [COMMAND_EXECUTION]: The skill utilizes the Python subprocess module to orchestrate video processing tasks via external command-line tools.
  • Evidence: Multiple scripts including assets/tools/build.py, assets/tools/build_vo.py, assets/tools/pipeline.py, assets/tools/download.py, assets/tools/transcribe.py, assets/tools/transcribe_cloud.py, and assets/tools/batch_vo.py execute ffmpeg, ffprobe, and other local utilities.
  • [EXTERNAL_DOWNLOADS]: The skill allows the agent to fetch media files from external URLs to be used as source material for editing.
  • Evidence: assets/tools/download.py employs the standard yt-dlp utility to download video and audio content from various web platforms.
  • [DYNAMIC_EXECUTION]: The skill generates visual overlays by rendering HTML and CSS templates at runtime.
  • Evidence: assets/tools/render_overlays.py invokes a headless Chrome browser to convert user-defined or agent-generated HTML snippets into PNG images for video compositing.
  • [INDIRECT_PROMPT_INJECTION]: The skill processes external data that could theoretically contain adversarial content, though it includes mitigations and warnings.
  • Ingestion points: The agent processes speech-to-text transcripts (transcript.json) and user-supplied metadata in overlays.json and edl.json.
  • Capability inventory: The skill can execute commands, render HTML, and write files based on processed input.
  • Sanitization: Basic character escaping is performed for subtitles, and the skill includes extensive troubleshooting documentation regarding model hallucinations.
  • Boundary markers: The skill instructions emphasize manual verification of transcripts and visual inspection of rendered frames to prevent errors or malicious injection.
  • [DATA_EXFILTRATION]: The skill communicates with external APIs to perform resource-intensive tasks like transcription.
  • Evidence: assets/tools/transcribe_cloud.py transmits audio data to well-known service providers (Groq and OpenAI) when local transcription is not available. These operations are transparent and consistent with the skill's documented functionality.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 3, 2026, 08:11 PM