opusclip
Pass
Audited by Gen Agent Trust Hub on Oct 19, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTIONDATA_EXFILTRATION
Full Analysis
- [COMMAND_EXECUTION]: The skill performs extensive local command execution for media processing. It utilizes tools such as
ffmpeg,ffprobe,yt-dlp, andnodevia the system shell. It also executes a bundled Node.js CLI atscripts/opusclipand uses utilities likeshasumandbrewfor environment setup and integrity checks. - [EXTERNAL_DOWNLOADS]: The skill leverages the
yt-dlputility to download video content from well-known social media platforms including YouTube, TikTok, and Instagram for local analysis and editing. - [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from external sources, creating a vulnerability surface for indirect prompt injection. * Ingestion points: External data enters through the
opusclip project transcriptcommand and theopusclip_analyze_reference_mediaMCP tool output. * Boundary markers: The instructions do not specify the use of delimiters or 'ignore' instructions for the processed transcript text. * Capability inventory: The skill has significant local capabilities including shell execution, file system access, and network communication. * Sanitization: No explicit sanitization or content filtering is described for the external video metadata or transcripts. - [DATA_EXFILTRATION]: The
scripts/telemetry.mjsscript transmits anonymous usage statistics (such as tool availability, revisions, and aspect ratios) to Mixpanel (api.mixpanel.com). This telemetry is documented and uses a well-known analytics service.
Audit Metadata