zynna-analyze-video
Pass
Audited by Gen Agent Trust Hub on Apr 17, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSPROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill communicates with the Zynna Open Skills API to perform video analysis. It includes safety logic to enforce HTTPS for remote connections while allowing local development on HTTP.
- [PROMPT_INJECTION]: The skill retrieves and persists untrusted video transcripts and visual descriptions from TikTok. This creates an indirect prompt injection surface for other skills or agents that process these artifacts in subsequent steps.
- Ingestion points: Data enters via the
client.analyzemethod inlib/analyze-video.js, which fetches content from TikTok videos. - Boundary markers: Absent. The skill writes raw transcript data directly to text and JSON files without delimiters or instructions to ignore embedded commands.
- Capability inventory: The skill has the capability to write to the filesystem and perform network requests.
- Sanitization: No sanitization or content filtering is performed on the retrieved video data before it is stored in the
.artifacts/directory. - [COMMAND_EXECUTION]: The skill uses a Node.js runtime script (
scripts/run.js) to orchestrate the analysis process and manage the creation of local artifacts.
Audit Metadata