paw-cra-video-longform
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill utilizes shell commands and the Python subprocess module to invoke ffmpeg and ffprobe for video assembly, audio mixing, and format validation. These operations are core to the skill's functionality but represent a command execution interface. Evidence is found in the video validation script (scripts/validate-video.py) and the assembly documentation (references/assembly-guide.md).
- [INDIRECT_PROMPT_INJECTION]: The production workflow processes untrusted user input in the form of video briefs and scripts (SKILL.md, Stages 1 and 2) to generate AI video prompts and narration. This lacks explicit boundary markers or sanitization, creating a potential surface for embedded instructions to influence agent behavior. Ingestion points: Stage 1 (Brief Intake) and Stage 2 (Script Development) in SKILL.md. Boundary markers: Absent. Capability inventory: The agent can invoke subprocess tools and perform network API operations. Sanitization: Absent.
Audit Metadata