gemini-omni-flash-api
Pass
Audited by Gen Agent Trust Hub on Sep 6, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill utilizes
subprocess.runto call theffmpegandffprobebinaries for media processing tasks, including audio stripping, video trimming, resolution normalization, and metadata inspection. These calls use structured argument lists rather than raw shell strings. - [EXTERNAL_DOWNLOADS]: The skill performs network operations to the official Google Gemini API endpoint (
generativelanguage.googleapis.com) to upload local media assets via the Files API and download generated video outputs. - [INDIRECT_PROMPT_INJECTION]:
- Ingestion points: User-provided prompts and prompt collections from local JSON or text files are interpolated into API requests (found in
scripts/video/generate_video.py). - Boundary markers: The skill uses the
google-genaiSDK's structured interaction objects, which provide structural separation between instructions and media assets. - Capability inventory: Includes network access (Google API), local file writing (in the
media/directory), and execution of local media processing tools. - Sanitization: Implements a
safe_user_pathhelper to ensure file operations are restricted to the current workspace and validates input parameters like duration and aspect ratio.
Audit Metadata