skills/szoloth/skills/video-analyzer/Gen Agent Trust Hub

video-analyzer

Pass

Audited by Gen Agent Trust Hub on Jun 30, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSDATA_EXFILTRATIONPROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The script scripts/prep_video_for_analysis.py executes several system commands via subprocess.run including ffmpeg, ffprobe, and various Whisper CLI implementations (mlx_whisper, whisper). These are used for media processing tasks like frame extraction and audio conversion. The script uses argument lists which prevents basic shell injection.
  • [EXTERNAL_DOWNLOADS]: The skill requires system-level installation of ffmpeg and recommends several Python packages (pillow, groq, mlx-whisper) for full functionality. These are standard libraries for media processing and AI transcription.
  • [DATA_EXFILTRATION]: When configured to use the groq transcription backend, the script transmits audio data to Groq's cloud API (api.groq.com). Groq is a well-known service, and the transmission is a core functional requirement of the transcription feature.
  • [PROMPT_INJECTION]: The skill is subject to indirect prompt injection. It transcribes audio from user-provided video files and inserts the resulting text into manifest.md and transcript.md without sanitization or boundary markers.
  • Ingestion points: Video file audio streams are processed in scripts/prep_video_for_analysis.py and converted to text.
  • Boundary markers: None. Transcribed segments are placed directly into Markdown files intended for AI consumption.
  • Capability inventory: The script has file system write access and executes subprocesses for media handling.
  • Sanitization: Absent. The script writes transcribed text exactly as received from the transcription engine.
Audit Metadata
Risk Level
SAFE
Analyzed
Jun 30, 2026, 08:26 PM
Security Audit — agent-trust-hub — video-analyzer