jianying-subtitles

Pass

Audited by Gen Agent Trust Hub on Sep 19, 2026

Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill interacts with a local Rust-based command-line interface (jianying) to perform subtitle operations. It includes strict instructions to verify tool capabilities (capabilities --json) and versions (--version) before any execution to ensure expected behavior.
  • [INDIRECT_PROMPT_INJECTION]: The skill ingests external subtitle data (SRT and ASS files). It implements defensive measures by mandating structural validation, checking for negative timestamps or unexpected overlaps, and verifying schemas before the agent processes the content, which mitigates the risk of instructions embedded in subtitle text being obeyed.
  • [SAFE]: The skill follows security best practices by requiring isolated file copies rather than modifying source files directly, enforcing precise user approval for potentially risky or costly actions (such as network-based translation), and prohibiting the collection or logging of user credentials. It also explicitly refuses to generate executable scripts (like Python) or use headless browsers.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 19, 2026, 11:55 PM
Security Audit — agent-trust-hub — jianying-subtitles