music-video
Pass
Audited by Gen Agent Trust Hub on Sep 22, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSDATA_EXFILTRATIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes local shell commands using ffmpeg and ffprobe for audio analysis and video muxing. It also executes a wrapper script (ofox-video.sh) provided by the ofox-video-core skill to handle API interactions.
- [EXTERNAL_DOWNLOADS]: The skill requires the ofox-video-core dependency, which includes shell scripts and reference documents fetched from the vendor's infrastructure.
- [DATA_EXFILTRATION]: The skill communicates with the vendor's API at app.ofox.ai to submit video generation jobs. The skill design explicitly processes audio files locally to prevent raw media from being uploaded to the remote service.
- [INDIRECT_PROMPT_INJECTION]: The skill processes user-supplied music metadata and visual descriptions which are interpolated into shell commands. It mitigates injection risks by instructing the agent to use quoted here-docs (cat <<'EOF') for command construction.
- Ingestion points: Processes user-provided audio paths and text descriptions in SKILL.md.
- Boundary markers: Uses structured prompt templates and consistency blocks to delimit instructions.
- Capability inventory: Executes bash, ffmpeg, curl, and jq via tool calls.
- Sanitization: Recommends shell here-doc patterns with disabled interpolation to prevent command injection from user text.
Audit Metadata