edit-video
Pass
Audited by Gen Agent Trust Hub on Sep 10, 2026
Risk Level: SAFECREDENTIALS_UNSAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [CREDENTIALS_UNSAFE]: The skill instructs the agent to read
docs/TOOLS-AND-API-KEYS.mdto set up services. This file is explicitly identified as a repository for sensitive configuration and credentials. - [COMMAND_EXECUTION]: The skill performs several command-line operations as part of its primary workflow:
- Executes
ffprobeto inspect video source streams. - Runs a local Node.js script
node scripts/transcribe-elevenlabs.mjsfor transcription services. - References various other local scripts and markdown files for sub-tasks like silence trimming and mistake cutting.
- [INDIRECT_PROMPT_INJECTION]: The skill processes video transcripts and project briefs which are external, potentially untrusted data sources.
- Ingestion points: Raw talking-head video audio (processed into text) and project files in
video-projects/<slug>/. - Boundary markers: None identified. There are no instructions for the agent to ignore or delimit instructions found within the transcripts.
- Capability inventory: The skill has capabilities for file system access (read/write), local command execution (
ffprobe,node), and network service interaction via transcription APIs. - Sanitization: No sanitization or validation of the transcript content is performed before the agent uses it for subsequent editing decisions or beat sheet generation.
Audit Metadata