videodb
Pass
Audited by Gen Agent Trust Hub on Apr 6, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [SAFE]: The skill demonstrates secure development practices by advising users to provide API keys via environment variables or .env files rather than hardcoding them within instructions or scripts.
- [COMMAND_EXECUTION]: Employs the Bash tool to run Python code that interacts with the VideoDB SDK for video ingestion, indexing, and timeline editing, which is consistent with the skill's primary purpose.
- [EXTERNAL_DOWNLOADS]: Fetches and installs the legitimate videodb and python-dotenv packages from standard Python package registries.
- [PROMPT_INJECTION]: The skill presents an inherent surface for indirect prompt injection as it processes transcripts and visual descriptions derived from external video sources.
- Ingestion points: External media is ingested from URLs and live streams as documented in SKILL.md and rtstream-reference.md.
- Boundary markers: Not explicitly defined in the provided examples, though the agent's instructions are focused on media processing workflows.
- Capability inventory: Uses Python execution to manage local state files and events, as seen in the ws_listener.py script.
- Sanitization: Standard SDK validation is used for media sources, though no specific filtering is mentioned for the content of transcripts or visual descriptions prior to analysis.
Audit Metadata