video-transcription
Pass
Audited by Gen Agent Trust Hub on Oct 23, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted external video data from local paths or HTTPS URLs. If the video content contains specific speech patterns, it could theoretically attempt to influence the agent's behavior during the transcription or conversion process.
- Ingestion points: The
--videoflag in thepostplus media transcribecommand accepts local file paths and remote HTTPS URLs as input. - Boundary markers: The instructions do not define specific delimiters or instructions to treat the transcribed content as untrusted data or to ignore instructions embedded within the speech.
- Capability inventory: The skill utilizes the
postplusCLI for execution and performs local file system writes to save transcriptions and subtitle files. - Sanitization: The skill focuses on timing validation for subtitle formats but lacks instructions for sanitizing or escaping the transcribed text to prevent prompt injection.
- [COMMAND_EXECUTION]: The skill relies on the execution of the
postplusCLI tool (e.g.,postplus media transcribe,postplus quote confirm) to perform its primary functions. These commands are vendor-specific and necessary for the intended media processing workflow.
Audit Metadata