video-analyzer
Warn
Audited by Gen Agent Trust Hub on Apr 7, 2026
Risk Level: MEDIUMCOMMAND_EXECUTIONEXTERNAL_DOWNLOADSDATA_EXFILTRATIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill provides instructions for the agent to execute shell commands with administrative privileges (sudo) to install system-level dependencies like FFmpeg. Evidence: SKILL.md contains sudo apt-get update && sudo apt-get install -y ffmpeg.
- [EXTERNAL_DOWNLOADS]: The skill relies on the npx package runner to download and install additional components from an external GitHub repository (AbsolutelySkilled). Evidence: README.md and SKILL.md include npx skills add AbsolutelySkilled/AbsolutelySkilled.
- [DATA_EXFILTRATION]: The skill directs the agent to perform an autonomous scan of multiple directories in the user's home folder (e.g., ~/.claude/skills/) to identify other installed skills, which constitutes broad file system access. Evidence: SKILL.md directs the agent to run ls ~/.claude/skills/ ~/.agent/skills/ ~/.agents/skills/.
- [PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it processes untrusted data from video files and frame-based AI vision analysis without using boundary markers or sanitization logic to isolate instructions from content. Ingestion points: Video files and frames via the Read tool. Capability inventory: Shell command execution (ffmpeg, npx, sudo), file system modifications, and network-based skill installation. Sanitization: Absent. Evidence: SKILL.md and vision-analysis-prompts.md.
Audit Metadata