opusclip
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTIONDYNAMIC_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from external video sources and transcripts, creating a vulnerability surface for the agent.
- Ingestion points: External data enters the context through
opusclip project createand transcript retrieval commands as documented inSKILL.md. - Boundary markers: No specific boundary markers or instructions are defined to isolate untrusted data from the agent's instructions.
- Capability inventory: The skill executes a bundled CLI utility, invokes
ffmpeg, and performs local file writes to generate previews. - Sanitization: There is no mention of sanitizing transcript data before it is presented to the agent for processing.
- [COMMAND_EXECUTION]: The skill utilizes a bundled script
scripts/opusclipand requires the external utilityffmpegto perform core media tasks. - [DYNAMIC_EXECUTION]: The skill generates an HTML preview file using
templates/preview.htmlby interpolating external project data, which constitutes local script generation from templates.
Audit Metadata