video-qa-frameproof
Pass
Audited by Gen Agent Trust Hub on Oct 27, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill facilitates the use of the
frameproof-video-qapackage vianpx, which downloads and executes the tool from the npm registry. This is consistent with the skill's purpose as a documentation layer for the utility and utilizes a well-known package registry. - [COMMAND_EXECUTION]: The skill provides instructions for executing various CLI commands to perform video validation, metadata scanning, and automated repair workflows (e.g.,
npx frameproof-video-qa verify,npx frameproof-video-qa scan). - [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process untrusted external data including video files, subtitle files, and JSON manifests to detect defects.
- Ingestion points:
SKILL.mdandreferences/verify-and-repair.mddescribe commands that read video files (--video), subtitle files (--captions), and manifest files (--manifest). - Boundary markers: No specific boundary markers or instructions to ignore embedded content are implemented for the ingested data.
- Capability inventory: The skill utilizes
npxto execute a scanner that performs file system reads and writes artifacts (JSON, HTML, SARIF). - Sanitization: The tool performs structured analysis of file metadata and contents, though no explicit sanitization of the input data is mentioned in the documentation.
Audit Metadata