claude-real-video-for-agents
Warn
Audited by Gen Agent Trust Hub on Jul 12, 2026
Risk Level: MEDIUMCOMMAND_EXECUTIONDATA_EXFILTRATIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill instructs the user or agent to execute a script named
install-skill.shto automate the installation. The content of this script is not included in the analyzed file set, which constitutes a risk of executing unverified code. - [DATA_EXFILTRATION]: The tool includes specific command-line flags (
--cookiesand--cookies-from-browser) that allow the agent to access sensitive session data from local browser profiles (Chrome, Safari, Firefox, Edge) or cookie files. This is a mechanism for accessing credential-heavy data. - [PROMPT_INJECTION]: This skill is designed to ingest and process untrusted external data from video URLs and local files. This creates a surface for indirect prompt injection, where malicious instructions could be embedded in visual frames or transcriptions. The skill attempts to mitigate this with a textual warning instructing the agent to treat media content as data rather than instructions.
- [COMMAND_EXECUTION]: The installation instructions include the use of
sudo apt install ffmpeg, which involves acquiring elevated system privileges.
Audit Metadata