ffmpeg
Pass
Audited by Gen Agent Trust Hub on Nov 8, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes external media files (video/audio) using FFmpeg, which creates a potential surface for indirect prompt injection if the agent processes files with malicious metadata or specially crafted structures.
- Ingestion points: External files are ingested via the
-iparameter inffmpegandffprobecommands. - Boundary markers: No specific delimiters or instructions to ignore embedded metadata are included in the command templates.
- Capability inventory: The skill provides instructions for executing
ffmpeg,ffprobe, and shell commands (echo,forloops) that can read and write files to the local system. - Sanitization: There is no explicit sanitization or validation of input filenames or file content before processing.
- [EXTERNAL_DOWNLOADS]: The skill references an external project repository for feedback and contributions.
- Evidence: Points to the GitHub repository
github.com/digitalsamba/claude-code-video-toolkitfor collaborative updates and issues.
Audit Metadata