media-files-conversion-ffmpeg

Pass

Audited by Gen Agent Trust Hub on Oct 11, 2026

Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill executes the ffmpeg utility to perform media operations via a wrapper script.
  • The scripts/ffmpeg_helper.py script manages execution using subprocess.run() with list-based arguments. This approach avoids shell metacharacter expansion and prevents command injection by treating all inputs as literal arguments.
  • [INDIRECT_PROMPT_INJECTION]: The skill handles user-provided file paths, which serves as a potential input vector for indirect instructions.
  • Ingestion points: File names and paths provided via command-line arguments to the scripts/ffmpeg_helper.py script.
  • Boundary markers: The skill does not use explicit boundary markers or delimiters for file path inputs.
  • Capability inventory: The skill has the ability to execute system commands via subprocess and perform file system operations.
  • Sanitization: Input is sanitized by using list-based execution in subprocess.run, which prevents shell-based command injection. The risk is considered low as the behavior is consistent with the primary purpose of the skill.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 11, 2026, 01:18 AM