video
Pass
Audited by Gen Agent Trust Hub on Oct 12, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [REMOTE_CODE_EXECUTION]: The skill executes
npx -y mcp-video-analyzer@latest, which downloads and runs a package from the npm registry at runtime. This package is maintained by the skill's author and is the primary tool for video analysis in environments without a dedicated MCP server. - [COMMAND_EXECUTION]: The skill uses the Bash tool to run shell commands for video processing, package execution, and interacting with the
mcp-video-analyzerCLI. - [INDIRECT_PROMPT_INJECTION]: The skill extracts and processes data from external videos (transcripts, OCR, metadata), which could contain malicious instructions designed to influence the agent's behavior.
- Ingestion points: Analysis output from
mcp-video-analyzercontaining timestamped transcripts, on-screen OCR text, and video metadata inSKILL.md. - Boundary markers: Absent. The instructions do not define specific delimiters to separate the extracted video content from the agent's instructions.
- Capability inventory: The agent possesses
Bashexecution privileges, the ability toReadlocal files (for frame inspection), and access to themcp__video-analyzertoolset. - Sanitization: The skill performs initial URL validation to block access to private/LAN addresses and metadata endpoints, though this can be overridden by user configuration.
- [EXTERNAL_DOWNLOADS]: At runtime, the skill downloads dependencies from the npm registry and uses
yt-dlpto fetch media from external platforms like YouTube, Instagram, and TikTok.
Audit Metadata