video-editing

Pass

Audited by Gen Agent Trust Hub on Apr 3, 2026

Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [COMMAND_EXECUTION]: The skill instructions involve generating and running shell commands (FFmpeg) and scripts based on analysis performed by the AI. This includes batch processing segments and concatenation using file lists.
  • [PROMPT_INJECTION]: The workflow ingests external data (video transcripts) to generate structural plans and FFmpeg commands. This creates a surface for indirect prompt injection where malicious instructions embedded in a transcript could influence the AI's generated code.
  • Ingestion points: Video transcripts processed during the Organization layer (SKILL.md).
  • Boundary markers: No specific delimiters or safety instructions are defined in the example prompts to separate content from instructions.
  • Capability inventory: Shell execution (FFmpeg), Python (ElevenLabs API), and Node.js (Remotion) are all part of the workflow.
  • Sanitization: The instructions do not specify validation or sanitization steps for the input data before it is used for code generation.
  • [EXTERNAL_DOWNLOADS]: The skill references and interacts with several well-known external services and platforms.
  • Fetches audio assets from ElevenLabs' text-to-speech API.
  • Utilizes npx for Remotion, which involves executing code and potentially downloading packages from the npm registry.
  • References generative visual and audio assets from fal.ai.
Audit Metadata
Risk Level
SAFE
Analyzed
Apr 3, 2026, 10:24 AM