videodb

Pass

Audited by Gen Agent Trust Hub on Apr 6, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [SAFE]: The skill demonstrates secure development practices by advising users to provide API keys via environment variables or .env files rather than hardcoding them within instructions or scripts.
  • [COMMAND_EXECUTION]: Employs the Bash tool to run Python code that interacts with the VideoDB SDK for video ingestion, indexing, and timeline editing, which is consistent with the skill's primary purpose.
  • [EXTERNAL_DOWNLOADS]: Fetches and installs the legitimate videodb and python-dotenv packages from standard Python package registries.
  • [PROMPT_INJECTION]: The skill presents an inherent surface for indirect prompt injection as it processes transcripts and visual descriptions derived from external video sources.
  • Ingestion points: External media is ingested from URLs and live streams as documented in SKILL.md and rtstream-reference.md.
  • Boundary markers: Not explicitly defined in the provided examples, though the agent's instructions are focused on media processing workflows.
  • Capability inventory: Uses Python execution to manage local state files and events, as seen in the ws_listener.py script.
  • Sanitization: Standard SDK validation is used for media sources, though no specific filtering is mentioned for the content of transcripts or visual descriptions prior to analysis.
Audit Metadata
Risk Level
SAFE
Analyzed
Apr 6, 2026, 04:02 AM
Security Audit — agent-trust-hub — videodb