videodb
Pass
Audited by Gen Agent Trust Hub on Apr 11, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill utilizes the Bash tool to execute Python scripts and manage a background WebSocket listener (
ws_listener.py). This is required for its core functionality of capturing real-time desktop sessions and processing video streams. - [EXTERNAL_DOWNLOADS]: The skill instructs the agent to install the
videodbPython SDK andpython-dotenvfrom standard package registries. These are necessary dependencies for interacting with the VideoDB service. - [PROMPT_INJECTION]: The skill exhibits a surface for indirect prompt injection as it processes untrusted data such as video transcripts and visual descriptions through LLM integration (
coll.generate_text). - Ingestion points: External video content is ingested via
video.get_transcript_text()andvideo.index_scenes(). - Boundary markers: Prompts provided in examples lack explicit delimiters (e.g., XML tags or triple backticks) to wrap the untrusted transcript content.
- Capability inventory: The skill has access to file system writes (local events log) and network operations (VideoDB API calls).
- Sanitization: There is no evidence of transcript content sanitization or filtering before it is sent to the LLM for summarization or analysis.
Audit Metadata