videodb
Pass
Audited by Gen Agent Trust Hub on Oct 24, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTIONDATA_EXFILTRATION
Full Analysis
- [COMMAND_EXECUTION]: The skill utilizes the Bash tool to execute Python code snippets and scripts. This is the intended delivery mechanism for interacting with the VideoDB SDK, using heredocs and standard input to run programmatic video operations.
- [EXTERNAL_DOWNLOADS]: The setup instructions direct the installation of the
videodbandpython-dotenvpackages from official package registries. These are established tools required for the skill's functionality. - [INDIRECT_PROMPT_INJECTION]: The skill handles untrusted data sources, including external video URLs, RTSP live feeds, and meeting recordings. This content is processed by AI models for transcription and visual indexing, representing a standard injection surface for multimedia-processing agents.
- Ingestion points: Video/audio files from remote URLs, local paths, and live streams (SKILL.md, api-reference.md).
- Boundary markers: Absent from instructions; content is passed directly to indexing and search functions.
- Capability inventory: Shell execution (python), network requests via SDK, and local file system access (Read/Grep/Glob/Bash).
- Sanitization: Relies on internal SDK handling and underlying model guardrails.
- [DATA_EXFLLTRATION]: While the skill monitors desktop activity (including screen capture and transcripts) and generates playable stream links, all network operations are directed at the official VideoDB infrastructure (
videodb.io). The user is instructed to manage their own API keys via.envfiles, preventing accidental exposure of credentials to the agent instructions.
Audit Metadata