clip
Pass
Audited by Gen Agent Trust Hub on Sep 25, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSDATA_EXFILTRATIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill invokes the
ffmpegutility viaexecFileto perform video processing tasks, including cutting segments and reframing landscape video to portrait aspect ratios. - [EXTERNAL_DOWNLOADS]: The worker scripts download video assets and STT (Speech-to-Text) transcript data from the vendor's domains, specifically
portal-media.perso.aiandperso.ai, which is necessary for the skill's primary function. - [DATA_EXFILTRATION]: The skill implements telemetry to track usage, sending metadata such as project IDs, clip counts, and error reports to the vendor's API at
perso.ai. - [INDIRECT_PROMPT_INJECTION]: The skill processes external data in the form of video transcripts and user-defined JSON clipping plans.
- Ingestion points: Transcription data is fetched from the vendor API in
scripts/clip.mjs, and JSON-formatted clip definitions are provided through the--clipsargument. - Boundary markers: Absent.
- Capability inventory: The skill performs file system writes (
writeFileSync), network communication (fetch,get), and shell command execution (ffmpeg) withinscripts/clip.mjs. - Sanitization: Filenames are sanitized in
lib/clipper.mjsusing thesanitizefunction to remove illegal characters.
Audit Metadata