video-understanding

Pass

Audited by Gen Agent Trust Hub on Aug 25, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill uses the subprocess module to execute ffmpeg and ffprobe for media processing tasks such as scene detection, frame extraction, and audio analysis. These operations are performed on local files and are essential for the skill's functionality.
  • [EXTERNAL_DOWNLOADS]: The skill makes authenticated outbound API requests to MiMo services (api.xiaomimimo.com) to perform Automatic Speech Recognition (ASR) and Vision-Language Model (VLM) analysis. These external interactions are expected given the skill's purpose and use a user-provided API key.
  • [PROMPT_INJECTION]: The skill ingests untrusted data from video content and ASR transcripts which are subsequently used in LLM prompts for summarization. While this provides an attack surface for indirect prompt injection, the risk is mitigated by built-in quality control checks and specific instructional boundaries provided in the agent brief.
  • [SAFE]: Sensitive credentials like the MIMO_API_KEY are managed through environment variables rather than being hardcoded. Additionally, the skill implements logic to redact API keys and data URLs from error logs, adhering to security best practices for credential handling.
Audit Metadata
Risk Level
SAFE
Analyzed
Aug 25, 2026, 08:53 AM
Security Audit — agent-trust-hub — video-understanding