video-edit
Pass
Audited by Gen Agent Trust Hub on Mar 27, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The script jump_cut_vad_singlepass.py uses torch.hub.load to download and execute code from the snakers4/silero-vad repository on GitHub. Additionally, SKILL.md instructs the user to run npm install within the video_effects directory for 3D rendering capabilities.\n- [COMMAND_EXECUTION]: The skill makes extensive use of subprocess.run across insert_3d_transition.py, jump_cut_vad_singlepass.py, and simple_video_edit.py to invoke system tools including ffmpeg, ffprobe, and npx remotion. These commands are used for video analysis, segment extraction, rendering, and concatenation.\n- [PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection in simple_video_edit.py. Audio content from user-provided videos is transcribed and interpolated into a prompt for the Claude API to generate YouTube descriptions and chapters.\n
- Ingestion points: simple_video_edit.py via transcribe_video (audio content from video files).\n
- Boundary markers: Absent; transcribed text is directly placed in the prompt.\n
- Capability inventory: jump_cut_vad_singlepass.py (subprocess/FFmpeg, file operations), insert_3d_transition.py (subprocess/FFmpeg/Remotion, file operations), simple_video_edit.py (subprocess/FFmpeg, file operations, network requests to Auphonic/Anthropic).\n
- Sanitization: Absent; content is not escaped or validated.
Audit Metadata