video-to-subtitle-summary

Pass

Audited by Gen Agent Trust Hub on Jul 19, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [COMMAND_EXECUTION]: The skill uses shell commands and Python's subprocess module to orchestrate external tools like ffmpeg for audio extraction and yt-dlp for YouTube subtitle retrieval. It also manages its own Python virtual environment for the faster-whisper backend. These executions are scoped to the skill's primary function of media processing.\n- [EXTERNAL_DOWNLOADS]: The skill performs network requests to fetch video content and metadata from platform URLs. It also downloads transcription models and dependencies from well-known mirrors (e.g., PyPI) during the setup process. All remote sources are standard for the tool's purpose.\n- [DATA_EXFILTRATION]: The skill interacts with video parsing services (ai-douyin.top9.cc or tikhub.io) to obtain download links. This involves transmitting API keys provided by the user in the .env configuration, which is the intended behavior for utilizing these external APIs.\n- [PROMPT_INJECTION]: The skill processes user-provided URLs and transcribed text, which represents a potential surface for indirect prompt injection. However, the instructions include boundary markers and contextual warnings for the LLM to mitigate the risk of following instructions embedded within the transcribed content.
Audit Metadata
Risk Level
SAFE
Analyzed
Jul 19, 2026, 01:59 PM
Security Audit — agent-trust-hub — video-to-subtitle-summary