video-understanding
Pass
Audited by Gen Agent Trust Hub on Aug 25, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill uses the
subprocessmodule to executeffmpegandffprobefor media processing tasks such as scene detection, frame extraction, and audio analysis. These operations are performed on local files and are essential for the skill's functionality. - [EXTERNAL_DOWNLOADS]: The skill makes authenticated outbound API requests to MiMo services (
api.xiaomimimo.com) to perform Automatic Speech Recognition (ASR) and Vision-Language Model (VLM) analysis. These external interactions are expected given the skill's purpose and use a user-provided API key. - [PROMPT_INJECTION]: The skill ingests untrusted data from video content and ASR transcripts which are subsequently used in LLM prompts for summarization. While this provides an attack surface for indirect prompt injection, the risk is mitigated by built-in quality control checks and specific instructional boundaries provided in the agent brief.
- [SAFE]: Sensitive credentials like the
MIMO_API_KEYare managed through environment variables rather than being hardcoded. Additionally, the skill implements logic to redact API keys and data URLs from error logs, adhering to security best practices for credential handling.
Audit Metadata