arcads-external-api

Pass

Audited by Gen Agent Trust Hub on Oct 30, 2026

Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
  • [INDIRECT_PROMPT_INJECTION]: The skill ingests and processes untrusted video and audio data for analysis and transcription. This creates a vulnerability surface where instructions in source media could influence AI prompt generation.
  • Ingestion points: Video and audio files processed in the analyze-video and clone-ad workflows.
  • Boundary markers: Mitigated by a mandatory 'Dialogue Confirmation Gate' requiring explicit human approval of extracted text before proceeding to generation.
  • Capability inventory: Executes subprocesses (ffmpeg, ffprobe, whisper), Node commands (npx hyperframes), and makes external API calls to external-api.arcads.ai.
  • Sanitization: Human-in-the-loop validation is the primary sanitization mechanism for extracted content.
  • [EXTERNAL_DOWNLOADS]: Recommends the installation of trusted third-party tools and libraries for core functionality.
  • Evidence: Recommends installing ffmpeg via Homebrew and openai-whisper via Pip.
  • [COMMAND_EXECUTION]: Executes shell scripts and CLI tools for media processing.
  • Evidence: Uses prompting/analyze-video/scripts/extract-frames.sh to wrap ffmpeg and ffprobe for frame and audio extraction; uses npx hyperframes for video captioning workflows.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 30, 2026, 03:11 AM