video-to-superprompt
Pass
Audited by Gen Agent Trust Hub on Sep 21, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill utilizes command-line tools
ffmpegandffprobeto process video files, extract frames, and retrieve technical metadata.\n - Evidence:
SKILL.mdincludes shell commands for frame extraction (ffmpeg -y -i "$VIDEO" ...) and metadata inspection (ffprobe -v error ...).\n- [INDIRECT_PROMPT_INJECTION]: The skill operates on untrusted external data by ingesting video files from local paths and remote URLs, which represents a potential surface for indirect prompt injection if the processed content contains malicious instructions.\n - Ingestion points: Local video paths, uploaded files, and external URLs mentioned in
SKILL.md.\n - Boundary markers: None specified to delimit ingested content from agent instructions.\n
- Capability inventory: Access to shell execution for media tools and file system writes for frame storage.\n
- Sanitization: No explicit content validation or sanitization is performed on the video metadata or content before processing.
Audit Metadata