media-files-conversion-ffmpeg
Pass
Audited by Gen Agent Trust Hub on Oct 11, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes the
ffmpegutility to perform media operations via a wrapper script. - The
scripts/ffmpeg_helper.pyscript manages execution usingsubprocess.run()with list-based arguments. This approach avoids shell metacharacter expansion and prevents command injection by treating all inputs as literal arguments. - [INDIRECT_PROMPT_INJECTION]: The skill handles user-provided file paths, which serves as a potential input vector for indirect instructions.
- Ingestion points: File names and paths provided via command-line arguments to the
scripts/ffmpeg_helper.pyscript. - Boundary markers: The skill does not use explicit boundary markers or delimiters for file path inputs.
- Capability inventory: The skill has the ability to execute system commands via
subprocessand perform file system operations. - Sanitization: Input is sanitized by using list-based execution in
subprocess.run, which prevents shell-based command injection. The risk is considered low as the behavior is consistent with the primary purpose of the skill.
Audit Metadata