ce-riffrec-feedback-analysis

Pass

Audited by Gen Agent Trust Hub on May 4, 2026

Risk Level: SAFE
Full Analysis
  • [COMMAND_EXECUTION]: The scripts/analyze_riffrec_zip.py script uses subprocess.run to execute ffmpeg, ffprobe, and curl. These calls utilize list-based arguments and incorporate path resolution and string sanitization (slugify), which effectively mitigates command injection risks.
  • [EXTERNAL_DOWNLOADS]: The script interacts with OpenAI's API (api.openai.com) via curl to perform audio-to-text transcription. This is a well-known service and the data transmission is essential to the skill's primary function.
  • [PROMPT_INJECTION]: The skill processes untrusted content from processed ZIP files (JSON metadata and audio/video transcripts). It implements boundary markers such as <discussion_transcript> and <video_frames> in generated artifacts to help downstream agents distinguish between data and instructions, reducing the risk of indirect prompt injection.
Audit Metadata
Risk Level
SAFE
Analyzed
May 4, 2026, 05:44 PM