ai-video-check
Pass
Audited by Gen Agent Trust Hub on Oct 3, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes local system commands through a provided shell script (
scripts/render_check.sh). It usesffmpegandffprobeto analyze video metrics andawkfor calculating duration differences and file density. These commands are constrained to local file analysis and are consistent with the skill's primary function of video validation. - [EXTERNAL_DOWNLOADS]: The instructions recommend that users install
ffmpegvia Homebrew (brew install ffmpeg) and utilizenpxfor tool-specific checks (HyperFrames). These downloads target well-known and trusted package management ecosystems and official tool repositories. - [INDIRECT_PROMPT_INJECTION]: The skill facilitates the ingestion of external data by processing video frames through a subagent for 'blind testing.' This creates a potential surface for indirect prompt injection if the video frames contain adversarial text or patterns intended to manipulate the subagent's interpretation.
- Ingestion points: Video file frames and generated contact sheets (
_sheet.jpg) are read by subagents (SKILL.md). - Boundary markers: None present; the subagent is instructed to review the content without specific security delimiters.
- Capability inventory: The script
render_check.shand the main agent have access to file system operations and command execution (ffmpeg,ffprobe,npx). - Sanitization: No specific sanitization or filtering of visual content is performed before subagent review.
Audit Metadata