mj-video-publish-pack

Pass

Audited by Gen Agent Trust Hub on Jun 30, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [COMMAND_EXECUTION]: Executes several command-line tools to process media and manage repository state:
  • ffprobe for video duration and metadata extraction.
  • identify (ImageMagick) for image dimension and size verification.
  • git for checking repository status and identifying file changes.
  • wrangler (Cloudflare) for uploading processed images to the R2 storage bucket 01mvp-public-assets.
  • ffmpeg for video compression and format conversion recommendations.
  • rg (ripgrep) and pnpm for validating output content and repository build integrity.
  • [EXTERNAL_DOWNLOADS]: Performs network operations to verify asset availability and manage remote storage:
  • Uploads files to a remote R2 bucket using wrangler with the --remote flag.
  • Verifies the status of uploaded assets via curl requests to the CDN assets.01mvp.com.
  • [PROMPT_INJECTION]: The skill ingests untrusted external data in the form of SRT subtitle files, which serves as a potential surface for indirect prompt injection.
  • Ingestion points: Subtitle files (/path/to/video.srt) used as the primary content source.
  • Boundary markers: None present; the skill is instructed to use subtitle text as the main source for article generation.
  • Capability inventory: Significant shell access via wrangler, ffmpeg, git, and pnpm (Corepack).
  • Sanitization: None described; instructions focus on merging and correcting subtitles into natural paragraphs.
Audit Metadata
Risk Level
SAFE
Analyzed
Jun 30, 2026, 08:22 AM
Security Audit — agent-trust-hub — mj-video-publish-pack