reel-export

Pass

Audited by Gen Agent Trust Hub on Sep 26, 2026

Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill instructs the agent to execute ffmpeg and ffprobe shell commands to perform video transformation and metadata validation.
  • [INDIRECT_PROMPT_INJECTION]:
  • Ingestion points: The skill ingests untrusted user data including headlines (text), background hex codes, and video/logo files.
  • Boundary markers: None. The instructions do not define delimiters or specific 'ignore instructions' guards for the user-supplied content.
  • Capability inventory: The agent utilizes ffmpeg and ffprobe via the command line, providing a path for command injection if inputs are not handled carefully.
  • Sanitization: There are no instructions for escaping or validating the headline text or background color hex codes before they are used in the ffmpeg filter string, creating a vulnerability where a malicious user could attempt to break out of the command context.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 26, 2026, 11:29 PM