ffmpeg-video-editor
Pass
Audited by Gen Agent Trust Hub on Apr 8, 2026
Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill is designed to generate shell commands for the ffmpeg utility. While the templates use double quotes for path placeholders, the security depends on the agent's ability to sanitize user input to prevent command injection via shell metacharacters.
- [PROMPT_INJECTION]: The skill exhibits an indirect prompt injection surface (Category 8) by interpolating untrusted user data into executable command strings.
- Ingestion points: File paths and timestamp parameters provided by the user in SKILL.md templates.
- Boundary markers: Double-quoted placeholders are used to delimit parameters in the generated commands.
- Capability inventory: The skill enables the execution of the ffmpeg binary for file and media manipulation.
- Sanitization: The skill does not include explicit logic for sanitizing or escaping user-controlled strings.
Audit Metadata