video-steal

Pass

Audited by Gen Agent Trust Hub on Oct 13, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill executes shell commands using standard media utilities, including ffmpeg, ffprobe, and yt-dlp, to analyze video content, measure cuts, and extract audio features.
  • [EXTERNAL_DOWNLOADS]: Downloads video files from YouTube, Instagram, and TikTok using yt-dlp and a utility named treg. These downloads are central to the skill's purpose of analyzing existing video styles.
  • [EXTERNAL_DOWNLOADS]: Interacts with ElevenLabs APIs for advanced audio processing.
  • Evidence: Uses curl to send audio files to api.elevenlabs.io for voice isolation and to generate sound effects based on text prompts.
  • [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted media content and metadata from external sources, creating a surface for indirect prompt injection.
  • Ingestion points: Untrusted content is ingested through URLs provided by the user and processed via yt-dlp and ffmpeg.
  • Boundary markers: None are explicitly used in the instructions to separate data from instructions during the analysis phase.
  • Capability inventory: The skill possesses capabilities for network access, file system writes within its workspace, and command execution via the Bash tool.
  • Sanitization: The skill relies on the inherent parsing safety of mature tools like ffmpeg and yt-dlp to handle potentially malicious media files.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 13, 2026, 12:38 AM