ffmpeg

Pass

Audited by Gen Agent Trust Hub on Nov 8, 2026

Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [INDIRECT_PROMPT_INJECTION]: The skill processes external media files (video/audio) using FFmpeg, which creates a potential surface for indirect prompt injection if the agent processes files with malicious metadata or specially crafted structures.
  • Ingestion points: External files are ingested via the -i parameter in ffmpeg and ffprobe commands.
  • Boundary markers: No specific delimiters or instructions to ignore embedded metadata are included in the command templates.
  • Capability inventory: The skill provides instructions for executing ffmpeg, ffprobe, and shell commands (echo, for loops) that can read and write files to the local system.
  • Sanitization: There is no explicit sanitization or validation of input filenames or file content before processing.
  • [EXTERNAL_DOWNLOADS]: The skill references an external project repository for feedback and contributions.
  • Evidence: Points to the GitHub repository github.com/digitalsamba/claude-code-video-toolkit for collaborative updates and issues.
Audit Metadata
Risk Level
SAFE
Analyzed
Nov 8, 2026, 07:56 AM