video-style-extractor
Pass
Audited by Gen Agent Trust Hub on Aug 8, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill fetches video content from arbitrary URLs using
yt-dlp. It also requires the installation of Python dependencies from PyPI viarequirements.txtand is distributed through a GitHub repository. - [COMMAND_EXECUTION]: The skill executes system tools (
ffmpeg,yt-dlp) and internal Python scripts viasubprocess.runto perform media analysis. It also includes instructions for the user to add an environment variable to their shell configuration file (e.g.,.bashrc) for persistent storage of the Gemini API key. - [PROMPT_INJECTION]: The skill processes external video data and URLs which are analyzed by an LLM, creating a surface for indirect prompt injection. Ingestion points: Video files and URLs processed via
yt-dlpand the Gemini API. Boundary markers: No explicit delimiters or boundary instructions are used when processing extracted video content. Capability inventory: Subprocess execution for media tools, local file system write access for artifacts and logs. Sanitization: Input paths are passed to subprocesses as lists to mitigate shell injection, though no explicit sanitization is performed on transcription or metadata content before it is recorded.
Audit Metadata