ffmpeg
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill provides numerous examples of shell commands using
ffmpegandffprobefor media transformation tasks. This is the core functionality of the skill and is intended for legitimate video production workflows. - [INDIRECT_PROMPT_INJECTION]: The skill facilitates processing external media files (video, audio, GIFs) and text-based file lists. If these files contain malicious metadata or crafted content, they could potentially influence the agent's behavior when it parses the output of the processing tools.
- Ingestion points: Input media files and
list.txtfiles are read byffmpegandffprobecommands inSKILL.mdandreference.md. - Boundary markers: No specific delimiters or instructions are provided to the agent to treat media metadata or command outputs as untrusted data.
- Capability inventory: The skill facilitates the execution of
ffmpegandffprobecommands and the creation of local text files via shell redirection. - Sanitization: There is no evidence of sanitization or validation of input file names or internal metadata before they are processed by the shell commands.
Audit Metadata