watch

Pass

Audited by Gen Agent Trust Hub on Aug 8, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [COMMAND_EXECUTION]: The skill executes system utilities including ffmpeg, ffprobe, and yt-dlp as subprocesses to handle video downloading and frame extraction. The implementation includes security hardening, such as resolving local paths to absolute locations and using the -- argument separator for yt-dlp to prevent argument injection attacks.
  • [EXTERNAL_DOWNLOADS]: The skill fetches video content from external URLs using yt-dlp and communicates with well-known transcription APIs (Groq and OpenAI) to process audio. These operations are essential to the skill's primary function and target established, reputable service providers.
  • [PROMPT_INJECTION]: The skill handles untrusted external data by ingesting video metadata and transcripts, creating an indirect prompt injection surface. The script mitigates this risk by encapsulating transcript content within markdown code blocks and providing clear context to the agent, reducing the likelihood of the model misinterpreting data as instructions.
Audit Metadata
Risk Level
SAFE
Analyzed
Aug 8, 2026, 06:06 AM
Security Audit — agent-trust-hub — watch