oc-verifier
Pass
Audited by Gen Agent Trust Hub on Sep 5, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill uses the
Bashtool to executeocCLI commands for mechanical verification andffmpegfor video sampling and analysis. - [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted external data, including subtitle files (.srt), transcripts, and project manifests, to verify deliverable quality. This represents an attack surface where instructions embedded in data could influence agent behavior.
- Ingestion points: Ingests
ocoutput JSON,.srtfiles, and transcript text during verification steps. - Boundary markers: The instructions do not define clear delimiters or "ignore instructions" prompts when reading subtitle or transcript content.
- Capability inventory: Uses
Bash(executingocandffmpeg) andRead(accessing the file system) to perform its checks. - Sanitization: There is no evidence of sanitization or filtering applied to the content of the SRT or transcript files before processing.
Audit Metadata