audio-editing
Pass
Audited by Gen Agent Trust Hub on Sep 2, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill performs audio operations by executing a local Python script
skills/shared/scripts/audio_ops.py, which acts as a wrapper for FFmpeg and FFprobe. The use of a dedicated script to manage command construction is a recommended practice to minimize command injection risks.- [INDIRECT_PROMPT_INJECTION]: The skill processes external media files, which represents an ingestion point for untrusted data. - Ingestion points: Audio and video files provided via the
input_fileparameter inSKILL.md. - Boundary markers: The instructions do not specify explicit delimiters for file content, but the data is processed by specialized binary tools (FFmpeg).
- Capability inventory: The skill has the capability to run subprocesses (FFmpeg/FFprobe) and write to the filesystem.
- Sanitization: The skill documentation explicitly states that parameters are determined by the script and commands are not manually spliced, which serves as a mitigation against injection.- [EXTERNAL_DOWNLOADS]: The skill references the official FFmpeg project website (
ffmpeg.org) for software requirements and installation guidance. This is a well-known and trusted source for audio/video processing software.
Audit Metadata