video-plan-editor
Pass
Audited by Gen Agent Trust Hub on Oct 7, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill is a well-documented tool for programmatic video editing. It utilizes a local Python package for schema validation and planning, ensuring that all operations are performed on structured data. The implementation demonstrates standard development practices, including automated testing and clear design specifications. No obfuscation, data exfiltration, or unauthorized command execution patterns were found.
- [INDIRECT_PROMPT_INJECTION]: The skill processes external inputs such as topics and URLs to generate video scripts and editing plans. This ingestion of external content constitutes a surface for indirect prompt injection, where instructions embedded in the source material could influence the agent's script generation or editing decisions. This risk is inherent to the skill's primary function and is mitigated by the use of structured data models.
- Ingestion points: User-supplied topics and URLs (pages or videos) processed via the
vpeCLI tool and analyzed by the agent inSKILL.md. - Boundary markers: The skill uses a structured JSON schema (
EditPlan) validated by Pydantic to maintain data integrity. - Capability inventory: The agent is authorized to execute the local
vpeCLI tool and useagent-browserto interact with a local image generation playground (inemaimgathttp://localhost:8000). - Sanitization: Input is classified by type in
detect.py, and the resulting plan is validated against specific guardrails invalidate.py.
Audit Metadata