video-qa

Pass

Audited by Gen Agent Trust Hub on Jul 18, 2026

Risk Level: SAFEREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
  • [REMOTE_CODE_EXECUTION]: The skill provides instructions to install the Homebrew package manager using a standard shell command that fetches a script from the official Homebrew repository. Homebrew is a well-known and widely used service for software installation.\n- [COMMAND_EXECUTION]: The skill includes command-line instructions for installing ffmpeg via various official package managers (apt, dnf, winget, choco) and for using ffmpeg and qlmanage to extract frames from video files. These commands are necessary for the skill's core functionality.\n- [EXTERNAL_DOWNLOADS]: Refers users to well-known online utilities like ezgif.com and cloudconvert.com as alternatives for video processing if local installation is not possible.\n- [PROMPT_INJECTION]: The skill processes untrusted project data, creating a surface for indirect prompt injection.\n
  • Ingestion points: The agent reads shot-list.md and generation-log.md provided by the user.\n
  • Boundary markers: The skill does not define specific delimiters to isolate external text data from its own instructions.\n
  • Capability inventory: The skill utilizes shell commands for video processing and frame extraction.\n
  • Sanitization: There is no evidence of explicit sanitization or filtering of the content read from project files.
Audit Metadata
Risk Level
SAFE
Analyzed
Jul 18, 2026, 10:35 PM