motion-design-video-analysis
Pass
Audited by Gen Agent Trust Hub on Oct 13, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTIONCOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes external media files (videos) which are then analyzed by an LLM.
- Ingestion points: The skill reads an external video file (in.mp4), extracts frames as JPEG images, and converts audio to a WAV format for transcription.
- Boundary markers: The instructions do not specify the use of clear delimiters or explicit instructions for the model to ignore potential malicious content embedded within the media frames or audio.
- Capability inventory: The skill has access to shell commands via ffmpeg and python, and can perform network requests to the OpenRouter API.
- Sanitization: No process is described for sanitizing or validating the binary content of the video or audio files before they are processed by local tools or sent to the LLM.
- [DYNAMIC_EXECUTION]: The skill involves generating and executing scripts at runtime to perform data analysis.
- Evidence: Step 7 provides a Python script for palette sampling that uses subprocess to call ffmpeg.
- Evidence: Step 4 describes using an "ephemeral script-run" to process JSON data and perform network requests to the OpenRouter API.
- [COMMAND_EXECUTION]: The skill relies on executing system commands to perform its primary function of media analysis.
- Evidence: Multiple steps use ffmpeg calls for metadata probing, audio detection, and frame sampling.
- [EXTERNAL_DOWNLOADS]: The skill requires the installation of external Python libraries from a public registry.
- Evidence: The prerequisites section instructs the user to install numpy and pillow using pip within a virtual environment.
Audit Metadata