skills/opus-pro/opus-skills/opusclip/Gen Agent Trust Hub

opusclip

Pass

Audited by Gen Agent Trust Hub on Sep 15, 2026

Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTIONDYNAMIC_EXECUTION
Full Analysis
  • [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from external video sources and transcripts, creating a vulnerability surface for the agent.
  • Ingestion points: External data enters the context through opusclip project create and transcript retrieval commands as documented in SKILL.md.
  • Boundary markers: No specific boundary markers or instructions are defined to isolate untrusted data from the agent's instructions.
  • Capability inventory: The skill executes a bundled CLI utility, invokes ffmpeg, and performs local file writes to generate previews.
  • Sanitization: There is no mention of sanitizing transcript data before it is presented to the agent for processing.
  • [COMMAND_EXECUTION]: The skill utilizes a bundled script scripts/opusclip and requires the external utility ffmpeg to perform core media tasks.
  • [DYNAMIC_EXECUTION]: The skill generates an HTML preview file using templates/preview.html by interpolating external project data, which constitutes local script generation from templates.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 15, 2026, 03:02 PM
Security Audit — agent-trust-hub — opusclip