recap-video
Pass
Audited by Gen Agent Trust Hub on Oct 30, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The
scripts/assemble.pyscript executes system commands viasubprocess.runto callffmpegandffprobe. These operations are used for media analysis, silent segment detection, and final video rendering. The script passes arguments as lists, which is a recommended security practice to prevent shell injection vulnerabilities. - [COMMAND_EXECUTION]: The
scripts/smoke-test.pyutility performs automated regression tests by invokingffmpegand the primary assembly script. These executions are contained within a temporary directory environment and are used to verify the integrity of the video assembly logic. - [INDIRECT_PROMPT_INJECTION]: The skill is designed to process untrusted external data, such as transcripts and edit decision lists (
transcript.json,edl-lines.json), which could contain malicious instructions. However, the logic inscripts/assemble.pytreats these inputs strictly as data for calculating timestamps and metadata, and does not execute or evaluate the content as code or prompt instructions.
Audit Metadata