video-sdk/windows
Pass
Audited by Gen Agent Trust Hub on Aug 26, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill defines patterns for handling untrusted input from session participants, which could be exploited for indirect prompt injection if the agent processes this data without boundaries.
- Ingestion points: The skill implements callbacks for receiving external data in
examples/session-join-pattern.md(chat),examples/transcription.md(transcription), andexamples/command-channel.md(custom signaling). - Boundary markers: The code samples lack delimiters or 'ignore' instructions when passing these participant-controlled strings to the application logic.
- Capability inventory: The skill integrates extensive networking, file system access (for recording), and media control functionalities.
- Sanitization: No sanitization, escaping, or validation of participant-provided strings is shown in the provided implementation examples.
- [DYNAMIC_EXECUTION]: The skill demonstrates the use of Foreign Function Interface (FFI) to invoke native Windows system libraries.
- Evidence:
examples/dotnet-winforms/README.mdutilizes[DllImport("gdi32.dll")]for native memory management during image processing.
Audit Metadata