arcads-external-api

Pass

Audited by Gen Agent Trust Hub on Jul 15, 2026

Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [COMMAND_EXECUTION]: The skill uses several system utilities to process media and manage files.
  • It calls ffmpeg and ffprobe to perform frame extraction and metadata analysis on user-supplied videos.
  • It utilizes whisper for transcribing audio content to derive dialogue scripts.
  • It uses the open command on macOS to allow the user to quickly review output directories.
  • [PROMPT_INJECTION]: The skill is designed to process untrusted external media, creating a surface for indirect prompt injection.
  • Ingestion points: Video and audio files provided by the user for the analyze-video and clone-ad workflows.
  • Boundary markers: The skill strictly enforces a "dialogue confirmation gate," requiring the agent to extract and present the script for explicit human approval before any generation occurs.
  • Capability inventory: The environment utilizes ffmpeg, whisper, and curl for its core operations.
  • Sanitization: Employs manual review checkpoints and shell quoting in utility scripts to prevent malicious payload execution.
  • [EXTERNAL_DOWNLOADS]: The skill communicates with external-api.arcads.ai to perform its primary function.
  • This domain is the official endpoint for the Arcads service.
  • The skill instructs the user to store credentials in a .env file to prevent accidental exposure in logs or chat history.
Audit Metadata
Risk Level
SAFE
Analyzed
Jul 15, 2026, 06:33 PM
Security Audit — agent-trust-hub — arcads-external-api