subject-compositing
Pass
Audited by Gen Agent Trust Hub on Aug 27, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill requires installing a specialized package directly from the vendor's GitHub repository at
https://github.com/scrollmark/social-skills/archive/refs/heads/master.tar.gz. This is a legitimate dependency for the skill's claimed functionality. - [COMMAND_EXECUTION]: The instructions provide several examples of shell command execution using the
video-studioutility to perform video processing, segmentation, and gesture analysis. - [INDIRECT_PROMPT_INJECTION]: The skill possesses a vulnerability surface by ingesting external video files and analyzing tool-generated event lists, which could potentially be manipulated.
- Ingestion points: External video files (
take.mp4,crowd.webm) and the output from the gesture tracking analysis (SKILL.md). - Boundary markers: None identified.
- Capability inventory: Execution of the
video-studiocommand-line tool which performs file operations and vision processing (SKILL.md). - Sanitization: No specific data validation or sanitization of the input video content is mentioned before it is processed by the tracking models.
Audit Metadata