amc-run-video-calibration

Pass

Audited by Gen Agent Trust Hub on Jul 15, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONDATA_EXFILTRATIONPROMPT_INJECTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill and its associated Python script perform multiple HTTP POST requests to a user-defined or default REST API endpoint to upload video files, ZIP archives, and JSON configurations.
  • [DATA_EXFILTRATION]: The primary purpose of the skill is the transmission of local multimedia files (MP4) and configuration data to an external service. While documented as the intended behavior for the AutoMagicCalib toolset, this represents a deliberate movement of data from the host to a remote system.
  • [COMMAND_EXECUTION]: The instructions include shell command sequences using git, grep, realpath, and ls that the agent is expected to execute to verify the presence of project files in the host environment.
  • [PROMPT_INJECTION]: The skill possesses an indirect prompt injection surface as it ingests and processes untrusted data from local files (videos and configuration JSON) which are used to determine runtime parameters like the detector type without explicit sanitization.
  • Ingestion points: scripts/run_video_calibration.py reads from VIDEO_DIR and CONFIG_FILE.
  • Boundary markers: No specific delimiters or warnings are used when processing the content of the config files.
  • Capability inventory: The skill uses requests for network operations and instructions suggest shell execution for file verification.
  • Sanitization: The script uses standard JSON parsing but lacks validation or sanitization for the values extracted from the configuration files before applying them to logic.
Audit Metadata
Risk Level
SAFE
Analyzed
Jul 15, 2026, 10:05 AM
Security Audit — agent-trust-hub — amc-run-video-calibration