arcads-external-api
Pass
Audited by Gen Agent Trust Hub on Oct 30, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill ingests and processes untrusted video and audio data for analysis and transcription. This creates a vulnerability surface where instructions in source media could influence AI prompt generation.
- Ingestion points: Video and audio files processed in the
analyze-videoandclone-adworkflows. - Boundary markers: Mitigated by a mandatory 'Dialogue Confirmation Gate' requiring explicit human approval of extracted text before proceeding to generation.
- Capability inventory: Executes subprocesses (
ffmpeg,ffprobe,whisper), Node commands (npx hyperframes), and makes external API calls toexternal-api.arcads.ai. - Sanitization: Human-in-the-loop validation is the primary sanitization mechanism for extracted content.
- [EXTERNAL_DOWNLOADS]: Recommends the installation of trusted third-party tools and libraries for core functionality.
- Evidence: Recommends installing
ffmpegvia Homebrew andopenai-whispervia Pip. - [COMMAND_EXECUTION]: Executes shell scripts and CLI tools for media processing.
- Evidence: Uses
prompting/analyze-video/scripts/extract-frames.shto wrapffmpegandffprobefor frame and audio extraction; usesnpx hyperframesfor video captioning workflows.
Audit Metadata