clipcast-audio2video
Pass
Audited by Gen Agent Trust Hub on Sep 4, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes user-provided audio files by transcribing them and passing the resulting text to the Google Gemini API for scene analysis and query generation. This creates an attack surface where instructions embedded in the audio content could attempt to manipulate the LLM's output.
- Ingestion points: Transcribed audio content used for scene analysis and B-roll query generation in
SKILL.md. - Boundary markers: The skill description does not specify the use of delimiters or 'ignore' instructions for the processed transcript data.
- Capability inventory: The skill uses
FFmpegfor rendering, performs network calls to Pexels and Google APIs, and writes video/JSON files to the localoutputs/directory. - Sanitization: No explicit sanitization or filtering of the transcribed text is described before it is sent to the LLM.
- [COMMAND_EXECUTION]: The skill relies on executing a local Python script (
audio2video.py) and utilizes theFFmpegCLI tool for media processing. It references absolute file paths on the local system (/Users/prismosoft/Sites/Clipping/clipcast/) which correspond to the skill author's environment. - [EXTERNAL_DOWNLOADS]: The skill fetches stock footage from the Pexels API and interacts with the Google Gemini API. These are well-known services used for the skill's primary purpose of video generation.
Audit Metadata