arcads-video-edit
Pass
Audited by Gen Agent Trust Hub on Oct 30, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill orchestrates complex video editing tasks by executing shell commands for
ffmpegandffprobeacross multiple Python and TypeScript scripts. These commands are used for trimming, cropping, normalizing audio, and concatenating video segments. - [EXTERNAL_DOWNLOADS]: The
arcads_gen.pyscript communicates with the Arcads external API to generate and download video clips. Additionally, the skill utilizesnpx hyperframesto run a headless browser-based composition engine at runtime. - [INDIRECT_PROMPT_INJECTION]: The skill ingests external data such as video transcripts (via OpenAI Whisper) and user-defined EDL (Edit Decision List) configurations. This data is used to dynamically construct prompts for generative video and audio services, creating a potential surface for indirect prompt injection if malicious instructions are embedded in the source media or transcripts.
- [SAFE]: The skill follows security best practices by encouraging the use of
.envfiles for secret management and focusing operations on vendor-specific infrastructure. The recursive search for.envfiles inarcads_gen.pyis scoped to specific product keys and represents standard behavior for localized developer tools.
Audit Metadata