video-transcribe
Pass
Audited by Gen Agent Trust Hub on Aug 30, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes external tools like yt-dlp, ffmpeg, and ffprobe using Python's subprocess.run with argument lists. This is a secure practice that prevents shell injection vulnerabilities.
- [EXTERNAL_DOWNLOADS]: The skill retrieves video data and subtitles from user-provided URLs using yt-dlp, which is the primary function of the utility.
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted external caption data. Evidence chain: (1) Ingestion points: fetch_transcript.py reads data from external video sources; (2) Boundary markers: Transcripts are saved to a structured transcript.json file; (3) Capability inventory: The skill has file-write and subprocess execution permissions; (4) Sanitization: The script strips HTML tags and removes rolling caption duplicates to clean the input text.
Audit Metadata