cueframe-reference-video
Pass
Audited by Gen Agent Trust Hub on Nov 11, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill includes a bash script at
scripts/motion-grid.shused to generate reference grids and frame indices from video files. The script executes standard system utilities includingffmpeg,ffprobe,awk,grep, andmktemp. It follows best practices by usingset -euo pipefail, employingtrapfor cleanup of temporary directories, and properly quoting shell variables to prevent argument splitting. - [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process external video files (the 'reference film'). This represents a potential indirect injection surface if file metadata is used to influence logic.
- Ingestion points: The
INPUTargument inscripts/motion-grid.shand the 'reference media' described inSKILL.md. - Boundary markers: Not applicable for the shell script; instructions in
SKILL.mdadvise the agent to use available tools for evidence rather than assuming local access. - Capability inventory:
scripts/motion-grid.shperforms file system writes to an output directory and executes subprocesses for media analysis. - Sanitization: The script includes a critical sanitization step using
awkto validate that presentation timestamps (PTS) and frame indices are strictly numeric (/^-?[0-9]+$/) before they are used to dynamically construct theffmpegselect filter. This prevents metadata-based command injection.
Audit Metadata