analyze-video
Pass
Audited by Gen Agent Trust Hub on Oct 30, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill executes a bundled bash script
extract-frames.shand utilizes system utilities such asffmpeg,ffprobe, andwhisperto process user-provided video files for frame and audio extraction. - [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted external video data which presents a risk of indirect prompt injection. 1. Ingestion points: User-provided video files are processed via script and transcription tools in SKILL.md (Steps 1 and 2). 2. Boundary markers: No explicit delimiters are used when the agent processes the transcribed text and frame descriptions. 3. Capability inventory: The skill can write files to the prompt library, execute shell commands, and make network requests to the Arcads API. 4. Sanitization: No sanitization or validation of the transcribed audio or visual content is performed before the agent uses it to generate new instructions.
- [DYNAMIC_EXECUTION]: The skill generates new markdown files representing reusable prompting templates and saves them to a local library directory. This allows the agent to persist and reuse new behavioral patterns derived from external media.
- [EXTERNAL_DOWNLOADS]: The instructions suggest installing legitimate third-party media processing tools (
ffmpegvia Homebrew andopenai-whispervia pip) if they are not already present in the environment.
Audit Metadata