media-acquisition
Pass
Audited by Gen Agent Trust Hub on Aug 27, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill instructs the installation of the video-studio-engine package from a specific GitHub archive (github.com/scrollmark/social-skills). This represents a direct dependency on the author's own external repository for necessary CLI tools.
- [COMMAND_EXECUTION]: The scripts/prekey.py script uses the subprocess module to execute ffmpeg commands for sampling colors and applying chromakey filters. It uses list-based arguments which is a secure practice to prevent shell injection vulnerabilities.
- [INDIRECT_PROMPT_INJECTION]: The skill handles untrusted external data, including user-supplied URLs and results from third-party media providers.
- Ingestion points: User-supplied URLs and results from external media catalogs (Pexels, Pixabay, etc.) processed by the video-studio tool.
- Boundary markers: None identified in the instructions.
- Capability inventory: Shell command execution via ffmpeg, file system writes to project directories, and network requests via the video-studio CLI.
- Sanitization: The prekey.py script performs basic validation of file extensions (.webm).
Audit Metadata