video-clipper
Pass
Audited by Gen Agent Trust Hub on Jun 23, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSDATA_EXFILTRATIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes shell commands for FFmpeg, ffprobe, and yt-dlp to perform video manipulation and metadata extraction. This is consistent with its primary purpose.
- [EXTERNAL_DOWNLOADS]: Fetches video files from user-provided URLs via curl and yt-dlp. It also triggers the download of the OpenAI Whisper machine learning model upon its first initialization.
- [DATA_EXFILTRATION]: Transfers video segments to third-party services (Klap.app and Captions.ai) to perform speaker-tracked reframing and animated caption generation. These operations are performed using the user's own API keys as documented.
- [PROMPT_INJECTION]: The skill processes untrusted content by transcribing and analyzing external video data. This creates a surface for indirect prompt injection if the video contains spoken instructions meant to influence the AI's scoring or captioning logic. However, the risk is mitigated by the specific task focus and human-in-the-loop checkpoints.
Audit Metadata