video-enhancement
Pass
Audited by Gen Agent Trust Hub on Sep 20, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill instructions provide templates for the agent to execute shell commands using tools like
ffmpeg,yt-dlp, andcurl. These commands incorporate user-supplied inputs such as video URLs and timestamps. The provided templates use quoting for variables to reduce the risk of shell injection. - [INDIRECT_PROMPT_INJECTION]: The skill processes external media and metadata from platforms like YouTube. This represents a potential surface for indirect prompt injection where instructions could be hidden in video titles or metadata.
- Ingestion points: Metadata and video content fetched from external URLs via
yt-dlp. - Boundary markers: None explicitly defined in the provided instruction set.
- Capability inventory: Local file system writes to
/tmp, network access viacurl, and shell command execution. - Sanitization: No specific sanitization logic is described; the skill relies on the agent's internal safety guardrails for processing external tool output.
- [EXTERNAL_DOWNLOADS]: The skill downloads content from well-known video hosting services (YouTube and Bilibili) and communicates with the vendor's official domain (
verging.ai) to perform enhancement jobs. These activities are required for the skill's primary function.
Audit Metadata