video-edit
Pass
Audited by Gen Agent Trust Hub on Mar 6, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONDATA_EXFILTRATIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill uses
subprocess.runto invoke external tools likeffmpeg,ffprobe,yt-dlp, andnpxfor video processing tasks. These calls are implemented using list-based arguments to prevent shell injection and are essential for the skill's documented functionality. - [EXTERNAL_DOWNLOADS]: The
jump_cut_vad_singlepass.pyscript downloads the Silero VAD model viatorch.hub.loadfrom a well-known repository. Additionally,youtube_clip.pyutilizesyt-dlpto download content from YouTube as requested by the user. Node dependencies for video rendering are also installed during the skill's setup process. - [DATA_EXFILTRATION]: The
simple_video_edit.pyscript uploads video data to Auphonic for processing and sends transcription segments to the Anthropic API to generate metadata. These network operations are explicitly described in the skill's documentation and are necessary for the automated editing and distribution features. - [PROMPT_INJECTION]: The skill is subject to indirect prompt injection in
simple_video_edit.py, which transcribes input video audio and includes the text in a prompt sent to an LLM for summarization. While no boundary markers are explicitly used to sanitize the transcript, this risk is inherent to tools that process untrusted content and is mitigated by the specific task-oriented nature of the prompt.
Audit Metadata