video-add-b-roll
Pass
Audited by Gen Agent Trust Hub on Oct 23, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill uses
ffmpegandffprobefor media processing via Python'ssubprocessmodule. Commands are invoked using argument lists rather than shell strings, mitigating command injection risks. Paths and parameters are validated before execution. - [EXTERNAL_DOWNLOADS]: Stock footage is retrieved from Pexels. The skill enforces HTTPS and restricts network access to legitimate Pexels domains using a whitelist-based URL validator.
- [INDIRECT_PROMPT_INJECTION]: While the skill ingests transcript data, it uses this information only for metadata labeling and UI display. It does not interpolate untrusted text into executable code or security-sensitive logic.
- [SAFE]: The implementation provides clear instructions for secure API key storage in local environment files and avoids exposing secrets in command-line arguments or logs.
Audit Metadata