video-edit

Pass

Audited by Gen Agent Trust Hub on Mar 6, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONDATA_EXFILTRATIONPROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill uses subprocess.run to invoke external tools like ffmpeg, ffprobe, yt-dlp, and npx for video processing tasks. These calls are implemented using list-based arguments to prevent shell injection and are essential for the skill's documented functionality.
  • [EXTERNAL_DOWNLOADS]: The jump_cut_vad_singlepass.py script downloads the Silero VAD model via torch.hub.load from a well-known repository. Additionally, youtube_clip.py utilizes yt-dlp to download content from YouTube as requested by the user. Node dependencies for video rendering are also installed during the skill's setup process.
  • [DATA_EXFILTRATION]: The simple_video_edit.py script uploads video data to Auphonic for processing and sends transcription segments to the Anthropic API to generate metadata. These network operations are explicitly described in the skill's documentation and are necessary for the automated editing and distribution features.
  • [PROMPT_INJECTION]: The skill is subject to indirect prompt injection in simple_video_edit.py, which transcribes input video audio and includes the text in a prompt sent to an LLM for summarization. While no boundary markers are explicitly used to sanitize the transcript, this risk is inherent to tools that process untrusted content and is mitigated by the specific task-oriented nature of the prompt.
Audit Metadata
Risk Level
SAFE
Analyzed
Mar 6, 2026, 02:18 PM