mj-video-publish-pack
Pass
Audited by Gen Agent Trust Hub on Jun 30, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: Executes several command-line tools to process media and manage repository state:
ffprobefor video duration and metadata extraction.identify(ImageMagick) for image dimension and size verification.gitfor checking repository status and identifying file changes.wrangler(Cloudflare) for uploading processed images to the R2 storage bucket01mvp-public-assets.ffmpegfor video compression and format conversion recommendations.rg(ripgrep) andpnpmfor validating output content and repository build integrity.- [EXTERNAL_DOWNLOADS]: Performs network operations to verify asset availability and manage remote storage:
- Uploads files to a remote R2 bucket using
wranglerwith the--remoteflag. - Verifies the status of uploaded assets via
curlrequests to the CDNassets.01mvp.com. - [PROMPT_INJECTION]: The skill ingests untrusted external data in the form of SRT subtitle files, which serves as a potential surface for indirect prompt injection.
- Ingestion points: Subtitle files (
/path/to/video.srt) used as the primary content source. - Boundary markers: None present; the skill is instructed to use subtitle text as the main source for article generation.
- Capability inventory: Significant shell access via
wrangler,ffmpeg,git, andpnpm(Corepack). - Sanitization: None described; instructions focus on merging and correcting subtitles into natural paragraphs.
Audit Metadata