video-analysis
Pass
Audited by Gen Agent Trust Hub on Sep 11, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The README.md and SKILL.md instruct the agent to run local scripts (telemetry/version_check.py and telemetry/telemetry_log.py) when used within the full repository. The instructions explicitly forbid these scripts from logging sensitive information such as URLs, transcripts, or credentials, and warn against remote telemetry.
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted external data from YouTube transcripts and video footage. It includes specific defensive instructions to treat all processed text and model outputs as evidence only, and never as instructions to operate accounts or take other actions.
- [SAFE]: The skill demonstrates safe credential management practices by instructing the agent to keep API keys for the Gemini service out of logs, command arguments, and public artifacts.
- [SAFE]: References to external services like the Gemini API and the google-genai SDK involve well-known, trusted providers and are documented appropriately for developer use.
Audit Metadata