arcads-external-api
Pass
Audited by Gen Agent Trust Hub on Jul 15, 2026
Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill uses several system utilities to process media and manage files.
- It calls
ffmpegandffprobeto perform frame extraction and metadata analysis on user-supplied videos. - It utilizes
whisperfor transcribing audio content to derive dialogue scripts. - It uses the
opencommand on macOS to allow the user to quickly review output directories. - [PROMPT_INJECTION]: The skill is designed to process untrusted external media, creating a surface for indirect prompt injection.
- Ingestion points: Video and audio files provided by the user for the
analyze-videoandclone-adworkflows. - Boundary markers: The skill strictly enforces a "dialogue confirmation gate," requiring the agent to extract and present the script for explicit human approval before any generation occurs.
- Capability inventory: The environment utilizes
ffmpeg,whisper, andcurlfor its core operations. - Sanitization: Employs manual review checkpoints and shell quoting in utility scripts to prevent malicious payload execution.
- [EXTERNAL_DOWNLOADS]: The skill communicates with
external-api.arcads.aito perform its primary function. - This domain is the official endpoint for the Arcads service.
- The skill instructs the user to store credentials in a
.envfile to prevent accidental exposure in logs or chat history.
Audit Metadata