video-performance-analyzer
Pass
Audited by Gen Agent Trust Hub on Sep 17, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes external video files and YouTube URLs to extract transcripts and visual cues. This content is subsequently analyzed by an LLM without explicit delimiters or instructions to ignore potential commands embedded within the video's audio or text.
- Ingestion points: Processes untrusted local .mp4 files and remote YouTube URLs through the
scripts/analyze_video.pyscript. - Boundary markers: The
ANALYSIS_PROMPTinside the script lacks explicit boundary markers or instructions to the model to disregard instructions contained within the video data. - Capability inventory: The skill executes local Python scripts, reads from the file system, and potentially writes to a Notion database if configured.
- Sanitization: No sanitization is performed on the verbatim transcripts or extracted visual data before they are provided to the model.
- [EXTERNAL_DOWNLOADS]: The skill instructs the user to install the
google-genaiPython package, which is the official SDK for Google's Gemini models. - [COMMAND_EXECUTION]: The skill operation involves executing the
scripts/analyze_video.pyscript to perform video uploads to the Gemini Files API and manage the generation of analysis reports.
Audit Metadata