sjinn-compose
Pass
Audited by Gen Agent Trust Hub on Jul 19, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSDATA_EXFILTRATION
Full Analysis
- [COMMAND_EXECUTION]: The skill uses the
sjinnCLI to perform video processing. It constructs shell commands by interpolating user-supplied video URLs and file paths into the--video-urlsargument. - [EXTERNAL_DOWNLOADS]: The skill requires the
@sjinn-build/clipackage. As a vendor-owned resource (sjinn-ai), this is standard for the skill's functionality. - [DATA_EXFILTRATION]: Local video files or remote URLs are passed to the vendor's CLI, which involves transmitting these assets or their references to the vendor's infrastructure for processing.
- [PROMPT_INJECTION]:
- Ingestion points: Video URLs and local file paths provided by the user (SKILL.md).
- Boundary markers: The instructions do not specify any delimiters or safety markers to prevent malicious filenames or URLs from influencing the command execution.
- Capability inventory: The skill has the capability to execute subprocesses (
sjinn compose) and write files to the local system (--download). - Sanitization: No sanitization or validation steps are defined to check the integrity or safety of the input strings before they are passed to the shell.
Audit Metadata