video-understand
Pass
Audited by Gen Agent Trust Hub on Apr 4, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The script
understand_video.pyexecutesffmpegandffprobeusing list-based arguments withsubprocess.run, which effectively prevents command injection from untrusted filenames.- [EXTERNAL_DOWNLOADS]: The script offers to install theopenai-whisperpackage from PyPI usingpipif it is not already available. This is a standard and transparent procedure for managing local Python dependencies.- [PROMPT_INJECTION]: The skill processes video audio to generate transcripts, creating an indirect prompt injection surface. Ingestion points: Video audio data is ingested and processed inunderstand_video.py. Boundary markers: Absent; the transcript text is included directly in the JSON output without specific delimiters or warnings. Capability inventory:understand_video.pyexecutesffmpegandffprobevia subprocess calls. Sanitization: No filtering or sanitization is applied to the generated transcript text. This is expected behavior for a transcription tool and is managed by the agent's core safety guardrails.
Audit Metadata