vss-summarize-video

Pass

Audited by Gen Agent Trust Hub on Sep 6, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill uses a bootstrap script (scripts/vss-bootstrap.sh) to download the Video Search & Summarization (VSS) application source code from the official vendor repository on GitHub (github.com/open-edge-platform/edge-ai-libraries.git) if it is not already present in the workspace. This is a standard setup procedure for the platform and targets an authoritative source.
  • [COMMAND_EXECUTION]: The skill executes local shell commands and the curl utility to interact with the Pipeline Manager API. This includes running the vss-bootstrap.sh script to resolve the application root and using jq to parse API responses. These operations are necessary for the skill's primary function and are performed against the user's local or configured environment.
  • [INDIRECT_PROMPT_INJECTION]: The skill processes video summaries and captions generated by the VSS backend and presents them to the user. This represents an injection surface if the backend-generated content were malicious, though the risk is low given it is a trusted platform component.
  • Ingestion points: Video summaries and chunk captions are retrieved from the GET /manager/summary/{stateId} and GET /manager/summary/{stateId}/raw API endpoints.
  • Boundary markers: The skill does not define specific delimiters or instructions to ignore embedded content in the retrieved summaries.
  • Capability inventory: The skill can execute shell commands (curl, bash, jq) and perform network operations against the configured $HOST.
  • Sanitization: No explicit sanitization or filtering of the backend-generated text is performed before presentation to the user.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 6, 2026, 01:43 PM
Security Audit — agent-trust-hub — vss-summarize-video