blitzreels-clipping
Pass
Audited by Gen Agent Trust Hub on Sep 17, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted content from external video platforms (YouTube, Instagram, TikTok, X, Facebook, Google Drive) as described in Step 1 of SKILL.md. This creates a surface for indirect prompt injection via video metadata or transcripts. Boundary markers are absent in the prompt instructions. Capability inventory includes vendor tool calls (clips_create), CLI execution (blitzreels agent-context), and file export operations. Sanitization is managed through mandatory user review of QA previews and warnings in Step 7.
- [COMMAND_EXECUTION]: The agent is instructed to execute the blitzreels CLI tool (blitzreels agent-context) to resolve tool contracts and project metadata. Evidence: SKILL.md Step 2. This is a vendor-owned resource used for internal coordination and state management.
Audit Metadata