google-short-videos-search
Pass
Audited by Gen Agent Trust Hub on Oct 10, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes a bash script (
scripts/search_google_short_videos.sh) which coordinates the search process usingcurlandpython3. - [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from an external API (Google Short Videos), which could contain adversarial instructions targeting the agent.
- Ingestion points: API response fetched in
scripts/search_google_short_videos.sh. - Boundary markers: The skill does not implement delimiters or safety warnings for the returned data.
- Capability inventory: Network operations via
curl, file system writes via the--outputflag, and script execution viabashandpython3. - Sanitization: The script ensures the response is valid JSON but does not sanitize the content for potential injection attacks.
- [DYNAMIC_EXECUTION]: The bash script uses inline Python code to perform runtime validation of arguments and API responses.
- The logic for parameter parsing and JSON validation is implemented as a heredoc executed by the Python interpreter.
Audit Metadata