video-editing
Pass
Audited by Gen Agent Trust Hub on Mar 24, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill uses shell commands for
ffmpegoperations (trimming, concatenating, and normalizing video) andnpx remotionfor programmatic video rendering. These are standard operations required for the skill's intended video editing functionality. - [EXTERNAL_DOWNLOADS]: The skill interacts with the ElevenLabs API via HTTP requests for voiceover generation and references fal.ai for media generation. These are recognized, well-known services within the AI development ecosystem.
- [PROMPT_INJECTION]: The skill describes a workflow where external data, such as video transcripts, is analyzed by an LLM to generate edit decision lists and commands. This presents a surface for indirect prompt injection if the source transcripts contain adversarial instructions.
- Ingestion points: External video transcripts processed during the organization phase (SKILL.md).
- Boundary markers: The instructions do not define specific delimiters or guardrails to isolate transcript content from the agent's control logic.
- Capability inventory: The skill performs shell execution via
ffmpegand rendering viaremotionbased on the analysis of these transcripts. - Sanitization: No explicit sanitization or validation logic is provided for the output generated from the transcript analysis before it is used in command execution.
Audit Metadata