cueframe-reference-video

Pass

Audited by Gen Agent Trust Hub on Nov 11, 2026

Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill includes a bash script at scripts/motion-grid.sh used to generate reference grids and frame indices from video files. The script executes standard system utilities including ffmpeg, ffprobe, awk, grep, and mktemp. It follows best practices by using set -euo pipefail, employing trap for cleanup of temporary directories, and properly quoting shell variables to prevent argument splitting.
  • [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process external video files (the 'reference film'). This represents a potential indirect injection surface if file metadata is used to influence logic.
  • Ingestion points: The INPUT argument in scripts/motion-grid.sh and the 'reference media' described in SKILL.md.
  • Boundary markers: Not applicable for the shell script; instructions in SKILL.md advise the agent to use available tools for evidence rather than assuming local access.
  • Capability inventory: scripts/motion-grid.sh performs file system writes to an output directory and executes subprocesses for media analysis.
  • Sanitization: The script includes a critical sanitization step using awk to validate that presentation timestamps (PTS) and frame indices are strictly numeric (/^-?[0-9]+$/) before they are used to dynamically construct the ffmpeg select filter. This prevents metadata-based command injection.
Audit Metadata
Risk Level
SAFE
Analyzed
Nov 11, 2026, 02:13 PM