video-breakdown

Pass

Audited by Gen Agent Trust Hub on Nov 6, 2026

Risk Level: SAFECOMMAND_EXECUTIONDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill executes shell scripts (prep.sh and contact-sheets.sh) that utilize system tools such as ffmpeg, ffprobe, and magick (ImageMagick) to extract frames, calculate video metrics, and generate contact sheets.
  • [DYNAMIC_EXECUTION]: Shell scripts use python3 to execute dynamically generated logic for mathematical calculations and string formatting via command-line arguments and heredocs, facilitating the processing of video metadata.
  • [INDIRECT_PROMPT_INJECTION]: The skill's primary workflow involves ingesting and processing data from an external AI (Gemini). It instructs the agent to provide a specific prompt to the external service and then process the resulting JSON object. This introduces an attack surface where malicious content within the processed video or the AI's response could attempt to influence the agent's behavior. Ingestion points: The agent reads the AI-generated JSON file and video metadata from local scripts. Boundary markers: The skill uses a detailed prompt with a strict JSON schema and 'Hard Rules' to constrain the external AI's output. Capability inventory: The skill performs file system operations, executes subprocesses (ffmpeg, magick, python), and interacts with external web services via a browser tool. Sanitization: The agent is instructed to validate the JSON schema version and presence of required keys before proceeding with the analysis.
Audit Metadata
Risk Level
SAFE
Analyzed
Nov 6, 2026, 01:58 AM