reel-export
Pass
Audited by Gen Agent Trust Hub on Sep 26, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill instructs the agent to execute
ffmpegandffprobeshell commands to perform video transformation and metadata validation. - [INDIRECT_PROMPT_INJECTION]:
- Ingestion points: The skill ingests untrusted user data including headlines (text), background hex codes, and video/logo files.
- Boundary markers: None. The instructions do not define delimiters or specific 'ignore instructions' guards for the user-supplied content.
- Capability inventory: The agent utilizes
ffmpegandffprobevia the command line, providing a path for command injection if inputs are not handled carefully. - Sanitization: There are no instructions for escaping or validating the headline text or background color hex codes before they are used in the
ffmpegfilter string, creating a vulnerability where a malicious user could attempt to break out of the command context.
Audit Metadata