ra-video-wash-pipeline
Warn
Audited by Gen Agent Trust Hub on Jul 27, 2026
Risk Level: MEDIUMCOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill frequently executes local Python scripts (
automation/scripts/wash_ledger.py,scripts/transcript.py,automation/scripts/check_delivery.py) through shell commands. User-supplied URLs are interpolated directly into these commands (e.g.,python3 automation/scripts/wash_ledger.py check "<url>"). While arguments are wrapped in double quotes, this pattern remains susceptible to command injection in environments where metacharacters are not properly sanitized by the underlying platform. - [EXTERNAL_DOWNLOADS]: The skill is specifically designed to ingest and process data from external video hosting platforms (YouTube, Bilibili, Douyin, Xiaohongshu) via user-provided URLs.
- [INDIRECT_PROMPT_INJECTION]: The skill processes potentially untrusted content extracted from external video transcripts and passes it through a multi-step rewrite and production pipeline.
- Ingestion points: External video URLs and local video files referenced in SKILL.md.
- Boundary markers: Absent. The instructions do not define delimiters or provide warnings to the agent to ignore instructions that might be embedded within the source video's transcript.
- Capability inventory: The skill possesses shell execution capabilities (via Python subprocesses) and file system write access to the
01-内容生产/directory. - Sanitization: No validation or sanitization of the extracted transcript content is specified before it is processed by the rewriting stack.
- [PROMPT_INJECTION]: The 'Source Privacy Boundary' section contains explicit instructions to the agent to suppress and hide internal artifacts (source transcript, title, and URL) from the user. While described as a privacy measure, this is a behavioral override that restricts data transparency and forces the agent to withhold source information.
Audit Metadata