skills/opus-pro/opus-skills/opusclip/Gen Agent Trust Hub

opusclip

Pass

Audited by Gen Agent Trust Hub on Oct 19, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTIONDATA_EXFILTRATION
Full Analysis
  • [COMMAND_EXECUTION]: The skill performs extensive local command execution for media processing. It utilizes tools such as ffmpeg, ffprobe, yt-dlp, and node via the system shell. It also executes a bundled Node.js CLI at scripts/opusclip and uses utilities like shasum and brew for environment setup and integrity checks.
  • [EXTERNAL_DOWNLOADS]: The skill leverages the yt-dlp utility to download video content from well-known social media platforms including YouTube, TikTok, and Instagram for local analysis and editing.
  • [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from external sources, creating a vulnerability surface for indirect prompt injection. * Ingestion points: External data enters through the opusclip project transcript command and the opusclip_analyze_reference_media MCP tool output. * Boundary markers: The instructions do not specify the use of delimiters or 'ignore' instructions for the processed transcript text. * Capability inventory: The skill has significant local capabilities including shell execution, file system access, and network communication. * Sanitization: No explicit sanitization or content filtering is described for the external video metadata or transcripts.
  • [DATA_EXFILTRATION]: The scripts/telemetry.mjs script transmits anonymous usage statistics (such as tool availability, revisions, and aspect ratios) to Mixpanel (api.mixpanel.com). This telemetry is documented and uses a well-known analytics service.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 19, 2026, 06:19 PM