video-upload-patterns
Pass
Audited by Gen Agent Trust Hub on Sep 20, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill uses
subprocess.runto invoke theffprobebinary. This is a standard procedure for extracting video metadata (duration, resolution, codecs) to ensure files meet platform requirements. - [EXTERNAL_DOWNLOADS]: The skill performs network operations to interact with official API endpoints for YouTube (Google API), TikTok, and Vimeo. These interactions are necessary for the skill's stated purpose of video management.
- [INDIRECT_PROMPT_INJECTION]: The skill features an attack surface for indirect prompt injection as it ingests external data for video titles, descriptions, and URLs without explicit boundary markers.
- Ingestion points: Video metadata templates (
VideoMetadataTemplate.render) and TikTok upload source URLs (TikTokVideo.video_url). - Boundary markers: None detected.
- Capability inventory: Network API calls via
requests,googleapiclient, andvimeolibraries. - Sanitization: Uses Python's
string.Template.safe_substitutefor metadata rendering, which provides basic protection against certain string manipulation issues but does not validate the content of the injected data.
Audit Metadata