broll

Pass

Audited by Gen Agent Trust Hub on Oct 14, 2026

Risk Level: SAFEDYNAMIC_EXECUTIONEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [DYNAMIC_EXECUTION]: The skill employs inline Node.js scripts to orchestrate library management logic, including directory traversal, metadata parsing, and the generation of library data structures (JSON and Markdown).
  • [EXTERNAL_DOWNLOADS]: Fetches location names from the OpenStreetMap Nominatim API to convert GPS coordinates found in video metadata into human-readable place names.
  • [COMMAND_EXECUTION]: Executes shell-level tools including ffmpeg and ffprobe to analyze video files and generate contact sheets, and uses cp and mkdir for managing the library's file structure.
  • [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted metadata from user-provided video files (such as titles, creation dates, and GPS tags) which are then processed by sub-agents to generate descriptions.
  • Ingestion points: The scan process in SKILL.md reads arbitrary file metadata from the creator's clips folder.
  • Boundary markers: The sub-agent tagging prompt uses a structured JSON schema to constrain the output format.
  • Capability inventory: The skill utilizes subprocess calls (node, ffmpeg, cp) and network operations (curl).
  • Sanitization: File-derived IDs are sanitized using regular expressions to allow only alphanumeric characters and hyphens.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 14, 2026, 09:39 AM