resolve-media-analysis

Pass

Audited by Gen Agent Trust Hub on Aug 31, 2026

Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
  • [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted external data in the form of media files for transcription (via Whisper) and vision analysis. This creates a surface where malicious instructions could be embedded in audio or video frames.
  • Ingestion points: The analyze_media function and Whisper integration read audio and frames from local disk as described in SKILL.md.
  • Boundary markers: There are no explicit instructions or delimiters mentioned to prevent the agent from treating decoded text or vision descriptions as instructions.
  • Capability inventory: The skill utilizes resolve_control and other MCP tools to interact with DaVinci Resolve projects and file systems.
  • Sanitization: The instructions do not define sanitization or filtering for the outputs generated from FFmpeg, FFprobe, or Whisper.
  • [COMMAND_EXECUTION]: The skill requires the execution of local system binaries including FFprobe, FFmpeg, and Whisper. While these are standard tools for the described workflow, they represent the execution of commands on the host system based on paths retrieved from the media pool.
Audit Metadata
Risk Level
SAFE
Analyzed
Aug 31, 2026, 10:27 PM