longform-to-shorts
Pass
Audited by Gen Agent Trust Hub on Oct 30, 2026
Risk Level: SAFECREDENTIALS_UNSAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
- [CREDENTIALS_UNSAFE]: The skill instructions in
references/ffmpeg-recipes.mdcontain a shell commandKEY=$(grep GROQ_API_KEY ~/.config/watch/.env | cut -d= -f2)which accesses a sensitive local environment file to retrieve an API key. - [EXTERNAL_DOWNLOADS]: The skill performs a network operation using
curlto send audio data to the Groq transcription service athttps://api.groq.com/openai/v1/audio/transcriptions. - [COMMAND_EXECUTION]: The workflow relies heavily on the execution of complex shell commands via
ffmpegandffprobeto perform video reframing, audio mixing, and subtitle burning. - [INDIRECT_PROMPT_INJECTION]: The skill processes transcription data (
words.json) generated from external audio input. This creates a surface where malicious instructions embedded in the audio could influence the output subtitles. The skill mitigates this by requiring a non-negotiable "HAND-REVIEW" and manual correction of all SRT files before they are used in the final video assembly. - [DYNAMIC_EXECUTION]: The skill executes a local Python script
scripts/gen_subs.pyto process transcription JSON and generate subtitle files based on an edited timeline.
Audit Metadata