video-transcription

Pass

Audited by Gen Agent Trust Hub on Oct 23, 2026

Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
  • [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted external video data from local paths or HTTPS URLs. If the video content contains specific speech patterns, it could theoretically attempt to influence the agent's behavior during the transcription or conversion process.
  • Ingestion points: The --video flag in the postplus media transcribe command accepts local file paths and remote HTTPS URLs as input.
  • Boundary markers: The instructions do not define specific delimiters or instructions to treat the transcribed content as untrusted data or to ignore instructions embedded within the speech.
  • Capability inventory: The skill utilizes the postplus CLI for execution and performs local file system writes to save transcriptions and subtitle files.
  • Sanitization: The skill focuses on timing validation for subtitle formats but lacks instructions for sanitizing or escaping the transcribed text to prevent prompt injection.
  • [COMMAND_EXECUTION]: The skill relies on the execution of the postplus CLI tool (e.g., postplus media transcribe, postplus quote confirm) to perform its primary functions. These commands are vendor-specific and necessary for the intended media processing workflow.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 23, 2026, 02:28 AM