video-analyzer
Pass
Audited by Gen Agent Trust Hub on Jun 30, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSDATA_EXFILTRATIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The script
scripts/prep_video_for_analysis.pyexecutes several system commands viasubprocess.runincludingffmpeg,ffprobe, and various Whisper CLI implementations (mlx_whisper,whisper). These are used for media processing tasks like frame extraction and audio conversion. The script uses argument lists which prevents basic shell injection. - [EXTERNAL_DOWNLOADS]: The skill requires system-level installation of
ffmpegand recommends several Python packages (pillow,groq,mlx-whisper) for full functionality. These are standard libraries for media processing and AI transcription. - [DATA_EXFILTRATION]: When configured to use the
groqtranscription backend, the script transmits audio data to Groq's cloud API (api.groq.com). Groq is a well-known service, and the transmission is a core functional requirement of the transcription feature. - [PROMPT_INJECTION]: The skill is subject to indirect prompt injection. It transcribes audio from user-provided video files and inserts the resulting text into
manifest.mdandtranscript.mdwithout sanitization or boundary markers. - Ingestion points: Video file audio streams are processed in
scripts/prep_video_for_analysis.pyand converted to text. - Boundary markers: None. Transcribed segments are placed directly into Markdown files intended for AI consumption.
- Capability inventory: The script has file system write access and executes subprocesses for media handling.
- Sanitization: Absent. The script writes transcribed text exactly as received from the transcription engine.
Audit Metadata