gemini-omni-flash-api

Pass

Audited by Gen Agent Trust Hub on Sep 6, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill utilizes subprocess.run to call the ffmpeg and ffprobe binaries for media processing tasks, including audio stripping, video trimming, resolution normalization, and metadata inspection. These calls use structured argument lists rather than raw shell strings.
  • [EXTERNAL_DOWNLOADS]: The skill performs network operations to the official Google Gemini API endpoint (generativelanguage.googleapis.com) to upload local media assets via the Files API and download generated video outputs.
  • [INDIRECT_PROMPT_INJECTION]:
  • Ingestion points: User-provided prompts and prompt collections from local JSON or text files are interpolated into API requests (found in scripts/video/generate_video.py).
  • Boundary markers: The skill uses the google-genai SDK's structured interaction objects, which provide structural separation between instructions and media assets.
  • Capability inventory: Includes network access (Google API), local file writing (in the media/ directory), and execution of local media processing tools.
  • Sanitization: Implements a safe_user_path helper to ensure file operations are restricted to the current workspace and validates input parameters like duration and aspect ratio.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 6, 2026, 05:18 PM
Security Audit — agent-trust-hub — gemini-omni-flash-api