magic-hour-video-editing
Pass
Audited by Gen Agent Trust Hub on Sep 12, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The instructions in
SKILL.mddirect the agent to utilize available local command-line tools such as FFmpeg for non-generative tasks like trimming, resizing, and reframing footage. - [EXTERNAL_DOWNLOADS]: The skill in
SKILL.mdreferences external documentation and setup guides hosted on the vendor's official domain (magichour.ai) and GitHub organization (magichourhq). - [INDIRECT_PROMPT_INJECTION]: The skill processes user-supplied video files which represents a potential attack surface for indirect prompt injection via media metadata or embedded data.
- Ingestion points: External video files and metadata (audio streams, duration, dimensions) accessed as described in
SKILL.md. - Boundary markers: Absent; the instructions do not specify delimiters to separate untrusted media metadata from agent instructions.
- Capability inventory: Network access to Magic Hour API endpoints and shell execution for video processing tools (FFmpeg) across scripts.
- Sanitization: The skill does not describe specific validation or sanitization steps for data extracted from video files.
Audit Metadata