video-editing
Pass
Audited by Gen Agent Trust Hub on Sep 2, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes a local Python script
skills/shared/scripts/video_ops.pyto perform video processing tasks. This script serves as a wrapper forffmpegandffprobebinaries. The instructions explicitly direct the agent to use this script instead of hand-crafting shell commands, which reduces the risk of improper shell syntax or unintended command behavior. - [INDIRECT_PROMPT_INJECTION]: The skill possesses a surface for indirect prompt injection as it processes user-supplied text for video overlays and file paths.
- Ingestion points: User-provided video file paths and text strings provided via the
--textargument in thetextsubcommand. - Boundary markers: The skill does not explicitly define delimiters for user-supplied data within its instructions, relying on the wrapper script for parameter handling.
- Capability inventory: The skill can read and write to the file system (specifically in the
outputs/directory) and execute subprocesses via thevideo_ops.pyscript. - Sanitization: The documentation indicates that the script handles common error points and parameter defaults, though the specific shell escaping logic for user strings is encapsulated within the script itself.
Audit Metadata