video-understand

Pass

Audited by Gen Agent Trust Hub on Apr 4, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The script understand_video.py executes ffmpeg and ffprobe using list-based arguments with subprocess.run, which effectively prevents command injection from untrusted filenames.- [EXTERNAL_DOWNLOADS]: The script offers to install the openai-whisper package from PyPI using pip if it is not already available. This is a standard and transparent procedure for managing local Python dependencies.- [PROMPT_INJECTION]: The skill processes video audio to generate transcripts, creating an indirect prompt injection surface. Ingestion points: Video audio data is ingested and processed in understand_video.py. Boundary markers: Absent; the transcript text is included directly in the JSON output without specific delimiters or warnings. Capability inventory: understand_video.py executes ffmpeg and ffprobe via subprocess calls. Sanitization: No filtering or sanitization is applied to the generated transcript text. This is expected behavior for a transcription tool and is managed by the agent's core safety guardrails.
Audit Metadata
Risk Level
SAFE
Analyzed
Apr 4, 2026, 11:00 PM