watch
Pass
Audited by Gen Agent Trust Hub on Aug 8, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill executes system utilities including
ffmpeg,ffprobe, andyt-dlpas subprocesses to handle video downloading and frame extraction. The implementation includes security hardening, such as resolving local paths to absolute locations and using the--argument separator foryt-dlpto prevent argument injection attacks. - [EXTERNAL_DOWNLOADS]: The skill fetches video content from external URLs using
yt-dlpand communicates with well-known transcription APIs (Groq and OpenAI) to process audio. These operations are essential to the skill's primary function and target established, reputable service providers. - [PROMPT_INJECTION]: The skill handles untrusted external data by ingesting video metadata and transcripts, creating an indirect prompt injection surface. The script mitigates this risk by encapsulating transcript content within markdown code blocks and providing clear context to the agent, reducing the likelihood of the model misinterpreting data as instructions.
Audit Metadata