skills/broomva/skills/video-cut/Gen Agent Trust Hub

video-cut

Pass

Audited by Gen Agent Trust Hub on Jun 28, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill executes ffmpeg and ffprobe via subprocess.run across several scripts (render.py, timeline_view.py, self_eval.py) to process video and audio. These executions use list-based arguments, which prevents shell injection, and the commands are restricted to the skill's core functionality.
  • [EXTERNAL_DOWNLOADS]: The transcribe_local.py script utilizes the faster-whisper library, which downloads pre-trained AI models from Hugging Face. The skill also mentions optional support for yt-dlp to download remote video sources. These are well-known services used for their intended purposes.
  • [PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it processes untrusted audio data and transcribes it into text that the agent interprets.
  • Ingestion points: Audio content from user-provided video files is transcribed into takes_packed.md, which serves as the primary input for the agent's reasoning.
  • Boundary markers: The takes_packed.md file uses Markdown headers and timestamped blocks to delimit segments.
  • Capability inventory: The skill can execute ffmpeg commands, write to the local file system, and potentially download external content via yt-dlp.
  • Sanitization: The skill does not currently sanitize or escape the transcribed text content to prevent the agent from following instructions embedded within the audio.
Audit Metadata
Risk Level
SAFE
Analyzed
Jun 28, 2026, 09:39 PM
Security Audit — agent-trust-hub — video-cut