analyze-video

Pass

Audited by Gen Agent Trust Hub on Oct 30, 2026

Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [COMMAND_EXECUTION]: The skill executes a bundled bash script extract-frames.sh and utilizes system utilities such as ffmpeg, ffprobe, and whisper to process user-provided video files for frame and audio extraction.
  • [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted external video data which presents a risk of indirect prompt injection. 1. Ingestion points: User-provided video files are processed via script and transcription tools in SKILL.md (Steps 1 and 2). 2. Boundary markers: No explicit delimiters are used when the agent processes the transcribed text and frame descriptions. 3. Capability inventory: The skill can write files to the prompt library, execute shell commands, and make network requests to the Arcads API. 4. Sanitization: No sanitization or validation of the transcribed audio or visual content is performed before the agent uses it to generate new instructions.
  • [DYNAMIC_EXECUTION]: The skill generates new markdown files representing reusable prompting templates and saves them to a local library directory. This allows the agent to persist and reuse new behavioral patterns derived from external media.
  • [EXTERNAL_DOWNLOADS]: The instructions suggest installing legitimate third-party media processing tools (ffmpeg via Homebrew and openai-whisper via pip) if they are not already present in the environment.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 30, 2026, 06:33 PM