translate-video
Pass
Audited by Gen Agent Trust Hub on Feb 27, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes multiple system commands using
ffmpegfor audio extraction and subtitle embedding,npx ts-nodefor running TypeScript scripts, andopento display the final output. - [EXTERNAL_DOWNLOADS]: The pipeline triggers
npm installwithin the directories of its dependent skills (/transcribeand/embed-subtitles) to ensure the necessary environment for its Node.js scripts. - [PROMPT_INJECTION]: The skill is susceptible to Indirect Prompt Injection (Category 8) because it ingests and processes untrusted data extracted from video files.
- Ingestion points: Transcription text and SRT files derived from user-provided video files are read by the LLM for translation and semantic refinement in Step 2 and Step 3.
- Boundary markers: Absent. There are no explicit delimiters or instructions provided to the agent to disregard potential instructions embedded within the transcript content.
- Capability inventory: The skill has the capability to execute shell commands (
ffmpeg,npx) and interact with the file system based on paths derived from the input video. - Sanitization: No sanitization or validation of the transcribed text is performed before it is re-processed by the LLM or used as input for the subtitle embedding step.
Audit Metadata