scribiz
Pass
Audited by Gen Agent Trust Hub on Oct 7, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONPERSISTENCE
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill requires the installation of the
scribizpackage via NPM (npm install -g scribiz) and system-level utilities includingffmpegandyt-dlpvia Homebrew to handle media processing. - [COMMAND_EXECUTION]: The skill utilizes a command-line interface (
scribiz) to perform operations such as media transcription, format conversion, and querying video content, which involves executing shell commands. - [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted external data from video platforms (transcripts, on-screen text, and metadata). This content could potentially contain malicious instructions designed to influence the agent's subsequent summaries or analysis of that media.
- [PERSISTENCE]: Instructions are provided to modify local configuration files, such as
~/.cursor/mcp.jsonand~/.codex/config.toml, to persistently register the Scribiz MCP server for use across different sessions.
Audit Metadata