clip

Pass

Audited by Gen Agent Trust Hub on Sep 25, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSDATA_EXFILTRATIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill invokes the ffmpeg utility via execFile to perform video processing tasks, including cutting segments and reframing landscape video to portrait aspect ratios.
  • [EXTERNAL_DOWNLOADS]: The worker scripts download video assets and STT (Speech-to-Text) transcript data from the vendor's domains, specifically portal-media.perso.ai and perso.ai, which is necessary for the skill's primary function.
  • [DATA_EXFILTRATION]: The skill implements telemetry to track usage, sending metadata such as project IDs, clip counts, and error reports to the vendor's API at perso.ai.
  • [INDIRECT_PROMPT_INJECTION]: The skill processes external data in the form of video transcripts and user-defined JSON clipping plans.
  • Ingestion points: Transcription data is fetched from the vendor API in scripts/clip.mjs, and JSON-formatted clip definitions are provided through the --clips argument.
  • Boundary markers: Absent.
  • Capability inventory: The skill performs file system writes (writeFileSync), network communication (fetch, get), and shell command execution (ffmpeg) within scripts/clip.mjs.
  • Sanitization: Filenames are sanitized in lib/clipper.mjs using the sanitize function to remove illegal characters.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 25, 2026, 04:56 AM