codex-youtube-video-workflow
Pass
Audited by Gen Agent Trust Hub on Jul 28, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSDATA_EXFILTRATIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes various local Python scripts and shell commands to perform video processing, including smart_cut.py, find_dubious_terms.py, finalize_subtitles.py, and make_vertical.py. It also relies on ffmpeg and the auto-editor tool.
- [EXTERNAL_DOWNLOADS]: Audio data is transmitted to the Groq API for transcription. Groq is a well-known third-party service provider.
- [DATA_EXFILTRATION]: Audio files extracted from user videos are sent to the external Groq service as a core part of the transcription workflow.
- [PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection as it ingests transcription data from video audio and uses it to generate marketing assets.
- Ingestion points: Transcriptions produced from raw video audio using the Groq API.
- Boundary markers: The skill does not implement delimiters or specific instructions to treat ingested transcription content as untrusted data.
- Capability inventory: The workflow includes capabilities for shell command execution and file system write operations.
- Sanitization: While basic filename sanitization is mentioned, no sanitization or filtering is applied to the content of the transcripts before they are incorporated into prompts for metadata generation.
Audit Metadata