video-to-subtitle-summary
Pass
Audited by Gen Agent Trust Hub on Jul 19, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill uses shell commands and Python's
subprocessmodule to orchestrate external tools likeffmpegfor audio extraction andyt-dlpfor YouTube subtitle retrieval. It also manages its own Python virtual environment for thefaster-whisperbackend. These executions are scoped to the skill's primary function of media processing.\n- [EXTERNAL_DOWNLOADS]: The skill performs network requests to fetch video content and metadata from platform URLs. It also downloads transcription models and dependencies from well-known mirrors (e.g., PyPI) during the setup process. All remote sources are standard for the tool's purpose.\n- [DATA_EXFILTRATION]: The skill interacts with video parsing services (ai-douyin.top9.ccortikhub.io) to obtain download links. This involves transmitting API keys provided by the user in the.envconfiguration, which is the intended behavior for utilizing these external APIs.\n- [PROMPT_INJECTION]: The skill processes user-provided URLs and transcribed text, which represents a potential surface for indirect prompt injection. However, the instructions include boundary markers and contextual warnings for the LLM to mitigate the risk of following instructions embedded within the transcribed content.
Audit Metadata