clipcast-audio2video

Pass

Audited by Gen Agent Trust Hub on Sep 4, 2026

Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [INDIRECT_PROMPT_INJECTION]: The skill processes user-provided audio files by transcribing them and passing the resulting text to the Google Gemini API for scene analysis and query generation. This creates an attack surface where instructions embedded in the audio content could attempt to manipulate the LLM's output.
  • Ingestion points: Transcribed audio content used for scene analysis and B-roll query generation in SKILL.md.
  • Boundary markers: The skill description does not specify the use of delimiters or 'ignore' instructions for the processed transcript data.
  • Capability inventory: The skill uses FFmpeg for rendering, performs network calls to Pexels and Google APIs, and writes video/JSON files to the local outputs/ directory.
  • Sanitization: No explicit sanitization or filtering of the transcribed text is described before it is sent to the LLM.
  • [COMMAND_EXECUTION]: The skill relies on executing a local Python script (audio2video.py) and utilizes the FFmpeg CLI tool for media processing. It references absolute file paths on the local system (/Users/prismosoft/Sites/Clipping/clipcast/) which correspond to the skill author's environment.
  • [EXTERNAL_DOWNLOADS]: The skill fetches stock footage from the Pexels API and interacts with the Google Gemini API. These are well-known services used for the skill's primary purpose of video generation.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 4, 2026, 09:01 PM