magic-hour-video-editing
Pass
Audited by Gen Agent Trust Hub on Nov 5, 2026
Risk Level: SAFECOMMAND_EXECUTIONDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill provides templates for local FFmpeg commands to perform video processing tasks like trimming, cropping, and joining clips. Evidence: Command examples are documented in references/finishing-recipes.md. \n- [DYNAMIC_EXECUTION]: Shell commands are dynamically constructed based on user-provided parameters such as timestamps and filenames. To mitigate injection risks, the skill explicitly instructs the agent to use external subtitle files (.ass) for text rendering instead of interpolating strings directly into shell commands. \n- [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted video data and user-provided prompts, creating an indirect injection surface. 1. Ingestion points: User-supplied video files and editing instructions (SKILL.md). 2. Boundary markers: Not explicitly defined. 3. Capability inventory: Local FFmpeg execution and network requests to the Magic Hour API (SKILL.md, references/finishing-recipes.md). 4. Sanitization: Instructions advocate for file-based captioning to prevent shell injection. \n- [EXTERNAL_DOWNLOADS]: The skill references OpenAPI specifications and technical documentation hosted on the vendor's official domains and GitHub repositories.
Audit Metadata