ce-riffrec-feedback-analysis
Pass
Audited by Gen Agent Trust Hub on May 4, 2026
Risk Level: SAFE
Full Analysis
- [COMMAND_EXECUTION]: The
scripts/analyze_riffrec_zip.pyscript usessubprocess.runto executeffmpeg,ffprobe, andcurl. These calls utilize list-based arguments and incorporate path resolution and string sanitization (slugify), which effectively mitigates command injection risks. - [EXTERNAL_DOWNLOADS]: The script interacts with OpenAI's API (
api.openai.com) viacurlto perform audio-to-text transcription. This is a well-known service and the data transmission is essential to the skill's primary function. - [PROMPT_INJECTION]: The skill processes untrusted content from processed ZIP files (JSON metadata and audio/video transcripts). It implements boundary markers such as
<discussion_transcript>and<video_frames>in generated artifacts to help downstream agents distinguish between data and instructions, reducing the risk of indirect prompt injection.
Audit Metadata