arcads-video-edit

Pass

Audited by Gen Agent Trust Hub on Oct 30, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill orchestrates complex video editing tasks by executing shell commands for ffmpeg and ffprobe across multiple Python and TypeScript scripts. These commands are used for trimming, cropping, normalizing audio, and concatenating video segments.
  • [EXTERNAL_DOWNLOADS]: The arcads_gen.py script communicates with the Arcads external API to generate and download video clips. Additionally, the skill utilizes npx hyperframes to run a headless browser-based composition engine at runtime.
  • [INDIRECT_PROMPT_INJECTION]: The skill ingests external data such as video transcripts (via OpenAI Whisper) and user-defined EDL (Edit Decision List) configurations. This data is used to dynamically construct prompts for generative video and audio services, creating a potential surface for indirect prompt injection if malicious instructions are embedded in the source media or transcripts.
  • [SAFE]: The skill follows security best practices by encouraging the use of .env files for secret management and focusing operations on vendor-specific infrastructure. The recursive search for .env files in arcads_gen.py is scoped to specific product keys and represents standard behavior for localized developer tools.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 30, 2026, 05:24 PM