drawing-video
Pass
Audited by Gen Agent Trust Hub on Oct 13, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTIONDYNAMIC_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted user-uploaded video files to generate narrative text that is subsequently used in prompts for image generation and captioning.
- Ingestion points: User-provided video files (
in.mov,small.mp4). - Boundary markers: The prompts do not use specific delimiters or instructions to ignore potentially malicious embedded content within the video analysis results.
- Capability inventory: Shell execution of
ffmpeg/ffprobeand network API access via thegemini_clienthelper. - Sanitization: No explicit filtering or validation of the grounded storyline is performed before it is interpolated into image generation prompts.
- [COMMAND_EXECUTION]: Utilizes local system tools
ffmpegandffprobeto analyze video files, extract frames, and compress clips. This is the core functionality for video processing. - [DYNAMIC_EXECUTION]: Loads helper scripts from a local path (
/mnt/skills/user/invoking-gemini/scripts) to facilitate communication with AI models. This represents standard modular development practices within the platform's skill environment.
Audit Metadata