broll
Pass
Audited by Gen Agent Trust Hub on Oct 14, 2026
Risk Level: SAFEDYNAMIC_EXECUTIONEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [DYNAMIC_EXECUTION]: The skill employs inline Node.js scripts to orchestrate library management logic, including directory traversal, metadata parsing, and the generation of library data structures (JSON and Markdown).
- [EXTERNAL_DOWNLOADS]: Fetches location names from the OpenStreetMap Nominatim API to convert GPS coordinates found in video metadata into human-readable place names.
- [COMMAND_EXECUTION]: Executes shell-level tools including
ffmpegandffprobeto analyze video files and generate contact sheets, and usescpandmkdirfor managing the library's file structure. - [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted metadata from user-provided video files (such as titles, creation dates, and GPS tags) which are then processed by sub-agents to generate descriptions.
- Ingestion points: The scan process in
SKILL.mdreads arbitrary file metadata from the creator's clips folder. - Boundary markers: The sub-agent tagging prompt uses a structured JSON schema to constrain the output format.
- Capability inventory: The skill utilizes subprocess calls (
node,ffmpeg,cp) and network operations (curl). - Sanitization: File-derived IDs are sanitized using regular expressions to allow only alphanumeric characters and hyphens.
Audit Metadata