varg-video-editing
Pass
Audited by Gen Agent Trust Hub on Nov 1, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill utilizes local shell commands (ffmpeg and ffprobe) to analyze video metadata, trim clips, and render final edits as part of its core functionality.
- [EXTERNAL_DOWNLOADS]: The skill integrates with multiple third-party APIs and services (e.g., ElevenLabs, HeyGen, Runway, Luma) for specialized video tasks like dubbing, lip-syncing, and AI restyling.
- [INDIRECT_PROMPT_INJECTION]: The workflow involves ingesting untrusted transcript data (JSON) to drive editing decisions and command construction.
- Ingestion points: External JSON transcript files processed during the 'Transcribe once' and 'Talking-head cleanup' phases.
- Boundary markers: The skill encourages the creation of an Edit Decision List (EDL) for human review before any rendering or paid API calls occur.
- Capability inventory: Shell execution (ffmpeg, ffprobe) and network operations (curl) are used to perform the requested edits.
- Sanitization: No explicit sanitization or escaping of transcript text before its use in decision-making is specified in the provided instructions.
Audit Metadata