videoediting
Pass
Audited by Gen Agent Trust Hub on Oct 3, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTIONDATA_EXFILTRATION
Full Analysis
- [COMMAND_EXECUTION]: The skill utilizes the Python subprocess module to orchestrate video processing tasks via external command-line tools.
- Evidence: Multiple scripts including
assets/tools/build.py,assets/tools/build_vo.py,assets/tools/pipeline.py,assets/tools/download.py,assets/tools/transcribe.py,assets/tools/transcribe_cloud.py, andassets/tools/batch_vo.pyexecuteffmpeg,ffprobe, and other local utilities. - [EXTERNAL_DOWNLOADS]: The skill allows the agent to fetch media files from external URLs to be used as source material for editing.
- Evidence:
assets/tools/download.pyemploys the standardyt-dlputility to download video and audio content from various web platforms. - [DYNAMIC_EXECUTION]: The skill generates visual overlays by rendering HTML and CSS templates at runtime.
- Evidence:
assets/tools/render_overlays.pyinvokes a headless Chrome browser to convert user-defined or agent-generated HTML snippets into PNG images for video compositing. - [INDIRECT_PROMPT_INJECTION]: The skill processes external data that could theoretically contain adversarial content, though it includes mitigations and warnings.
- Ingestion points: The agent processes speech-to-text transcripts (
transcript.json) and user-supplied metadata inoverlays.jsonandedl.json. - Capability inventory: The skill can execute commands, render HTML, and write files based on processed input.
- Sanitization: Basic character escaping is performed for subtitles, and the skill includes extensive troubleshooting documentation regarding model hallucinations.
- Boundary markers: The skill instructions emphasize manual verification of transcripts and visual inspection of rendered frames to prevent errors or malicious injection.
- [DATA_EXFILTRATION]: The skill communicates with external APIs to perform resource-intensive tasks like transcription.
- Evidence:
assets/tools/transcribe_cloud.pytransmits audio data to well-known service providers (Groq and OpenAI) when local transcription is not available. These operations are transparent and consistent with the skill's documented functionality.
Audit Metadata