ai-video-check

Pass

Audited by Gen Agent Trust Hub on Oct 3, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill executes local system commands through a provided shell script (scripts/render_check.sh). It uses ffmpeg and ffprobe to analyze video metrics and awk for calculating duration differences and file density. These commands are constrained to local file analysis and are consistent with the skill's primary function of video validation.
  • [EXTERNAL_DOWNLOADS]: The instructions recommend that users install ffmpeg via Homebrew (brew install ffmpeg) and utilize npx for tool-specific checks (HyperFrames). These downloads target well-known and trusted package management ecosystems and official tool repositories.
  • [INDIRECT_PROMPT_INJECTION]: The skill facilitates the ingestion of external data by processing video frames through a subagent for 'blind testing.' This creates a potential surface for indirect prompt injection if the video frames contain adversarial text or patterns intended to manipulate the subagent's interpretation.
  • Ingestion points: Video file frames and generated contact sheets (_sheet.jpg) are read by subagents (SKILL.md).
  • Boundary markers: None present; the subagent is instructed to review the content without specific security delimiters.
  • Capability inventory: The script render_check.sh and the main agent have access to file system operations and command execution (ffmpeg, ffprobe, npx).
  • Sanitization: No specific sanitization or filtering of visual content is performed before subagent review.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 3, 2026, 12:10 AM