video-screenshot
Pass
Audited by Gen Agent Trust Hub on Aug 21, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The script scripts/extract.py and its supporting library scripts/lib.py execute external binaries ffmpeg and ffprobe to process video files. The implementation follows security best practices by passing arguments as arrays to subprocess functions, which avoids shell command injection risks.
- [INDIRECT_PROMPT_INJECTION]: The skill establishes an indirect prompt injection surface by processing untrusted user video files (Ingestion point: extract.py) and directing the agent to review output frames (Capability inventory: subprocess calls for FFmpeg, file writing to archive). While boundary markers in SKILL.md provide review guidance, the risk is mitigated by sanitization using filename regex and standard JSON serialization for report metadata.
- [EXTERNAL_DOWNLOADS]: The skill relies on standard third-party dependencies including the Pillow image processing library and the rapidocr-onnxruntime OCR engine. These are fetched from official package registries (PyPI) as part of the normal installation and execution process.
Audit Metadata