video

Pass

Audited by Gen Agent Trust Hub on Oct 12, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [REMOTE_CODE_EXECUTION]: The skill executes npx -y mcp-video-analyzer@latest, which downloads and runs a package from the npm registry at runtime. This package is maintained by the skill's author and is the primary tool for video analysis in environments without a dedicated MCP server.
  • [COMMAND_EXECUTION]: The skill uses the Bash tool to run shell commands for video processing, package execution, and interacting with the mcp-video-analyzer CLI.
  • [INDIRECT_PROMPT_INJECTION]: The skill extracts and processes data from external videos (transcripts, OCR, metadata), which could contain malicious instructions designed to influence the agent's behavior.
  • Ingestion points: Analysis output from mcp-video-analyzer containing timestamped transcripts, on-screen OCR text, and video metadata in SKILL.md.
  • Boundary markers: Absent. The instructions do not define specific delimiters to separate the extracted video content from the agent's instructions.
  • Capability inventory: The agent possesses Bash execution privileges, the ability to Read local files (for frame inspection), and access to the mcp__video-analyzer toolset.
  • Sanitization: The skill performs initial URL validation to block access to private/LAN addresses and metadata endpoints, though this can be overridden by user configuration.
  • [EXTERNAL_DOWNLOADS]: At runtime, the skill downloads dependencies from the npm registry and uses yt-dlp to fetch media from external platforms like YouTube, Instagram, and TikTok.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 12, 2026, 01:28 AM