transcribe

Pass

Audited by Gen Agent Trust Hub on Jun 28, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill installs and executes a command-line tool named transcribe that orchestrates yt-dlp, ffmpeg, and Playwright to process video URLs via the Bash tool.
  • [EXTERNAL_DOWNLOADS]: The skill downloads machine learning models from the mlx-community organization on Hugging Face, which is a well-known repository for AI models.
  • [EXTERNAL_DOWNLOADS]: A local installation script install.sh is executed to set up third-party dependencies such as yt-dlp and Playwright.
  • [PROMPT_INJECTION]: The skill processes untrusted transcripts from external video sources, creating a potential surface for indirect prompt injection.
  • Ingestion points: Video URLs from YouTube, TikTok, and other platforms processed in SKILL.md.
  • Boundary markers: The output uses a markdown template to label metadata and transcript content.
  • Capability inventory: Uses the Bash tool to run the transcription pipeline.
  • Sanitization: No specific sanitization or filtering of transcript content is documented in the skill instructions.
Audit Metadata
Risk Level
SAFE
Analyzed
Jun 28, 2026, 12:23 PM
Security Audit — agent-trust-hub — transcribe