transcribe
Pass
Audited by Gen Agent Trust Hub on Sep 24, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted spoken content from external video platforms, which acts as a surface for indirect prompt injection if the content contains malicious instructions. * Ingestion points: Fetches transcripts from platforms like YouTube, Instagram, and TikTok (SKILL.md). * Boundary markers: Output is structured with markdown headers and platform/source labels (SKILL.md). * Capability inventory: Uses the Bash tool to execute transcription and audio extraction utilities (SKILL.md). * Sanitization: No specific filtering or sanitization of the transcript text is mentioned (SKILL.md).
- [EXTERNAL_DOWNLOADS]: The skill downloads a machine learning model (whisper-large-v3-mlx) from the well-known mlx-community organization on Hugging Face during initial use (SKILL.md).
- [COMMAND_EXECUTION]: The skill utilizes the Bash tool to run yt-dlp, ffmpeg, and Playwright for media extraction and web navigation (SKILL.md).
Audit Metadata