video-qa-frameproof

Pass

Audited by Gen Agent Trust Hub on Oct 27, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill facilitates the use of the frameproof-video-qa package via npx, which downloads and executes the tool from the npm registry. This is consistent with the skill's purpose as a documentation layer for the utility and utilizes a well-known package registry.
  • [COMMAND_EXECUTION]: The skill provides instructions for executing various CLI commands to perform video validation, metadata scanning, and automated repair workflows (e.g., npx frameproof-video-qa verify, npx frameproof-video-qa scan).
  • [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process untrusted external data including video files, subtitle files, and JSON manifests to detect defects.
  • Ingestion points: SKILL.md and references/verify-and-repair.md describe commands that read video files (--video), subtitle files (--captions), and manifest files (--manifest).
  • Boundary markers: No specific boundary markers or instructions to ignore embedded content are implemented for the ingested data.
  • Capability inventory: The skill utilizes npx to execute a scanner that performs file system reads and writes artifacts (JSON, HTML, SARIF).
  • Sanitization: The tool performs structured analysis of file metadata and contents, though no explicit sanitization of the input data is mentioned in the documentation.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 27, 2026, 10:20 AM