video-assemble

Pass

Audited by Gen Agent Trust Hub on Oct 7, 2026

Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [INDIRECT_PROMPT_INJECTION]:
  • Ingestion points: Data is processed from external files such as tts_meta.json, original_subtitles.json, visual_overlays.json, and user-provided subtitle files (JSON/SRT/ASS) in scripts/assemble.py and scripts/source_subtitles.py.
  • Boundary markers: Absent; the skill does not use explicit delimiters to separate untrusted data content from system instructions.
  • Capability inventory: System-level capabilities include complex audio/video manipulation and file generation via subprocess.run calls to ffmpeg and ffprobe, primarily wrapped in scripts/lib.py and scripts/adoption/strict_inputs.py.
  • Sanitization: The skill implements schema validation for JSON inputs and strict numeric range checking for parameters in scripts/adoption/strict_inputs.py. It also provides an escaping utility for drawtext filter text in scripts/visual_render.py to mitigate filter injection, although text content is otherwise largely preserved for final outputs.
  • [COMMAND_EXECUTION]:
  • The skill relies on system commands to perform its core media processing functions.
  • Evidence: Found in scripts/lib.py (run_cmd), scripts/adoption/strict_inputs.py (run_logged), and across specialized modules like scripts/compose_foreground.py and scripts/source_score.py which build command lists for FFmpeg execution based on input metadata.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 7, 2026, 07:23 AM