summarize-video

Pass

Audited by Gen Agent Trust Hub on May 5, 2026

Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill executes local Ruby scripts (summary_skeleton.rb and visual_script_extractor.rb) to process video transcripts and prepare files for the agent. These scripts operate on absolute file paths provided as command-line arguments.
  • [PROMPT_INJECTION]: Indirect prompt injection vulnerability: The skill ingests and processes content from an external JSON file (visual_transcript.json). * Ingestion points: agent_prompt.md and SKILL.md define tasks that read the visual transcript data. * Boundary markers: The sub-agent is instructed to use a pre-created skeleton file with specific HTML-comment placeholders (e.g., ) to structure its output. * Capability inventory: The agent has access to bash for running Ruby scripts, as well as Read and Edit tools for file manipulation. * Sanitization: There is no explicit sanitization or validation of the transcript content, meaning instructions embedded within the transcript data could potentially influence the sub-agent's behavior during the summarization process.
Audit Metadata
Risk Level
SAFE
Analyzed
May 5, 2026, 09:47 AM