video-check
Pass
Audited by Gen Agent Trust Hub on Nov 11, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill implements its core functionality via
scripts/check.pyandscripts/fix_sound.py. These scripts execute external binaries (ffmpegandffprobe) using the Pythonsubprocessmodule. - The execution calls use list-based arguments rather than shell strings, which effectively prevents shell injection vulnerabilities.
- Command parameters are derived from specific video measurements (floats/integers) or well-defined user inputs.
- [EXTERNAL_DOWNLOADS]: The skill includes evaluation scripts (
place-files.sh) that download sample video files for testing purposes. - These downloads target
edit.trysometh.ing, which is a vendor-owned domain associated with the authoreditatlas. - The skill instructions explicitly direct the agent to work with local files and advise against downloading from untrusted social media platforms.
- [INDIRECT_PROMPT_INJECTION]: The skill possesses an attack surface where it processes external video file metadata and streams.
- Ingestion points include file probing and audio analysis outputs from FFmpeg.
- Capability inventory includes the ability to generate reports and modify audio streams using
ffmpeg. - The skill mitigates risks by parsing tool outputs using regex and structured JSON loading, and it uses specific boundary templates (
REVIEW.md) to report findings to the user.
Audit Metadata