video-common

Pass

Audited by Gen Agent Trust Hub on Sep 26, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill uses standard command-line tools in references/delivery-qa.md to validate media assets. Specifically, it executes ffprobe to extract metadata and ffmpeg to check for decoding errors and stream alignment in the final video file (final.mp4).
  • [EXTERNAL_DOWNLOADS]: In references/fact-check.md, the instructions guide the agent to use curl with a browser User-Agent to retrieve content from external sources such as official government websites, corporate reports, and Wikipedia for the purpose of fact-checking and source documentation.
  • [INDIRECT_PROMPT_INJECTION]: The skill has a vulnerability surface for indirect prompt injection as it processes external content from the web and analyzes video files.
  • Ingestion points: External web content retrieved via curl and video metadata/streams processed by ffmpeg and ffprobe in references/fact-check.md and references/delivery-qa.md respectively.
  • Boundary markers: The skill does not define specific delimiters for external content but relies on cross-referencing information across multiple independent sources.
  • Capability inventory: The agent is authorized to execute shell commands (ffmpeg, ffprobe) and perform network requests (curl) to verified domains.
  • Sanitization: The workflow mitigates risk through manual visual inspection, required cross-verification (at least two sources for key facts), and strict adherence to official primary sources over secondary aggregators.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 26, 2026, 09:29 AM