vss-summarize-video
Pass
Audited by Gen Agent Trust Hub on Sep 6, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill uses a bootstrap script (
scripts/vss-bootstrap.sh) to download the Video Search & Summarization (VSS) application source code from the official vendor repository on GitHub (github.com/open-edge-platform/edge-ai-libraries.git) if it is not already present in the workspace. This is a standard setup procedure for the platform and targets an authoritative source. - [COMMAND_EXECUTION]: The skill executes local shell commands and the
curlutility to interact with the Pipeline Manager API. This includes running thevss-bootstrap.shscript to resolve the application root and usingjqto parse API responses. These operations are necessary for the skill's primary function and are performed against the user's local or configured environment. - [INDIRECT_PROMPT_INJECTION]: The skill processes video summaries and captions generated by the VSS backend and presents them to the user. This represents an injection surface if the backend-generated content were malicious, though the risk is low given it is a trusted platform component.
- Ingestion points: Video summaries and chunk captions are retrieved from the
GET /manager/summary/{stateId}andGET /manager/summary/{stateId}/rawAPI endpoints. - Boundary markers: The skill does not define specific delimiters or instructions to ignore embedded content in the retrieved summaries.
- Capability inventory: The skill can execute shell commands (
curl,bash,jq) and perform network operations against the configured$HOST. - Sanitization: No explicit sanitization or filtering of the backend-generated text is performed before presentation to the user.
Audit Metadata