codex-auto-clip-workflow
Pass
Audited by Gen Agent Trust Hub on Aug 22, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill instructs the agent to install standard video processing tools (FFmpeg) and well-known Python libraries (opencv-python, numpy, pillow) as prerequisites for the workflow.
- [COMMAND_EXECUTION]: The workflow heavily utilizes FFmpeg shell commands to perform technical tasks such as shot detection, frame extraction, and audio manipulation. These commands are standard for video processing and are used within the scope of the skill's stated purpose.
- [INDIRECT_PROMPT_INJECTION]: The skill involves processing external data (reference video files and asset libraries) which represents a standard ingestion surface. * Ingestion points: Reference video files and product asset files (SKILL.md). * Boundary markers: None identified. * Capability inventory: FFmpeg command execution, local file system writes, and network requests to the Doubao TTS API (references/prompts.md). * Sanitization: The skill relies on technical metadata extraction via FFmpeg rather than natural language instructions from the files.
- [DATA_EXPOSURE_AND_EXFILTRATION]: The skill makes network requests to the Doubao TTS API (a well-known service) for the purpose of voiceover generation as described in the workflow instructions. No sensitive data exfiltration or hardcoded credentials were detected.
Audit Metadata