video-common
Pass
Audited by Gen Agent Trust Hub on Sep 26, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill uses standard command-line tools in
references/delivery-qa.mdto validate media assets. Specifically, it executesffprobeto extract metadata andffmpegto check for decoding errors and stream alignment in the final video file (final.mp4). - [EXTERNAL_DOWNLOADS]: In
references/fact-check.md, the instructions guide the agent to usecurlwith a browser User-Agent to retrieve content from external sources such as official government websites, corporate reports, and Wikipedia for the purpose of fact-checking and source documentation. - [INDIRECT_PROMPT_INJECTION]: The skill has a vulnerability surface for indirect prompt injection as it processes external content from the web and analyzes video files.
- Ingestion points: External web content retrieved via
curland video metadata/streams processed byffmpegandffprobeinreferences/fact-check.mdandreferences/delivery-qa.mdrespectively. - Boundary markers: The skill does not define specific delimiters for external content but relies on cross-referencing information across multiple independent sources.
- Capability inventory: The agent is authorized to execute shell commands (
ffmpeg,ffprobe) and perform network requests (curl) to verified domains. - Sanitization: The workflow mitigates risk through manual visual inspection, required cross-verification (at least two sources for key facts), and strict adherence to official primary sources over secondary aggregators.
Audit Metadata