ffmpeg-rist-zmq

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The prompt shows and instructs embedding plaintext secrets/passwords directly in URLs/ffmpeg commands (e.g., rist://...&secret=hunter2 and icecast://source:secret@...), which requires the model to output secret values verbatim and is therefore insecure.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.75). The required runtime workflow for zmq-send takes the outsider-authored free-text --command argument (e.g., “Parsed_drawtext_0 text world”) and sends it over ZMQ to the zmq filter server, which then injects that text into ffmpeg’s runtime command handling context (indirect prompt-injection risk via untrusted free-form text).