watch
Pass
Audited by Gen Agent Trust Hub on Aug 19, 2026
Risk Level: SAFECOMMAND_EXECUTIONDATA_EXFILTRATIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill uses
ffmpegandffprobeto process local video files, extract frames, and isolate audio. These are standard tools for media processing and consistent with the skill's purpose. - [DATA_EXFILTRATION]: Audio data is sent to external Whisper backends, such as OpenAI or Groq, for transcription. This involves network operations to recognized services for functionality.
- [PROMPT_INJECTION]: The skill processes potentially untrusted content from video files into a report, creating a potential surface for indirect prompt injection.
- Ingestion points: Audio and visual content from the local video file provided as input.
- Boundary markers: The
observation.mdoutput does not specify the use of delimiters or warnings to separate transcribed content. - Capability inventory: Uses
ffmpeg,ffprobe, and external Whisper APIs. - Sanitization: No sanitization or filtering of transcribed text or visual observations is mentioned.
Audit Metadata