Agent skill · Audited from source
Media Processing
skill · vellum-ai/vellum-assistantMIT licenceAudited 14 Oct 2026 · source 19bc86343b63
Is it safe? Yes — SAFE, grade B (89/100). We read this skill's source at commit 19bc86343b63 and found no filesystem, network or shell access and no hard-coded secrets. What it does: Ingest and process media files (video, audio, image)
Cite
Cite this page
ModelsAtlas. “Media Processing (vellum-ai/vellum-assistant)”. Retrieved 14 Oct 2026. https://modelsatlas.com/skills/vellum-ai/media-processing
Trust audit
Audit 0.4.1 · source read 14 Oct 2026
SAFE means nothing in the source contradicts what the skill says it does. Grade B is shared by 13,985 of 14,816 audited skills.
What the source does
- FilesystemNone observedNo reads or writes in the source
- NetworkNone observedNo outbound calls in the source
- ShellNone observedNo commands run in the source
- DependenciesPinnedNothing floats
- SecretsNone foundNo keys in source
Five audit layers
| Layer | What we check | Result | Findings |
|---|---|---|---|
L0 Provenance | Repo owner, licence, archive status, activity | PASS | 5 |
L1 Static source | Secrets, path traversal, supply chain, hidden code | PASS | 5 |
L2 Instructions | Prompt injection, authority framing, hidden directives | PASS | 0 |
L3 Inventory | The files and declarations match the source | PASS | 0 |
L4 Sandbox | Run in isolation and watch behaviour | SKIPPED why | 0 |
Gates applied: no behavioural pass.
Findings (10)
LOWInventory / provenanceinv.symlink · assistant/CLAUDE.md
assistant/CLAUDE.md
- Why
- link not followed
- Fix
- —
LOWInventory / provenanceinv.symlink · assistant/src/approvals/CLAUDE.md
assistant/src/approvals/CLAUDE.md
- Why
- link not followed
- Fix
- —
LOWInventory / provenanceinv.symlink · assistant/src/notifications/CLAUDE.md
assistant/src/notifications/CLAUDE.md
- Why
- link not followed
- Fix
- —
LOWInventory / provenanceinv.symlink · assistant/src/runtime/CLAUDE.md
assistant/src/runtime/CLAUDE.md
- Why
- link not followed
- Fix
- —
LOWInventory / provenanceinv.symlink · gateway/CLAUDE.md
gateway/CLAUDE.md
- Why
- link not followed
- Fix
- —
LOWFilesystem / pathfs.traversal · __tests__/audio-transcribe.test.ts:3
import type { BatchTranscriber } from "../../../../stt/types.js";- Why
- No further detail recorded for this rule.
- Fix
- —
LOWFilesystem / pathfs.traversal · __tests__/audio-transcribe.test.ts:11
mock.module("../../../../providers/speech-to-text/resolve.js", () => ({- Why
- No further detail recorded for this rule.
- Fix
- —
LOWFilesystem / pathfs.traversal · __tests__/audio-transcribe.test.ts:23
mock.module("../../../../util/spawn.js", () => ({- Why
- No further detail recorded for this rule.
- Fix
- —
LOWFilesystem / pathfs.traversal · __tests__/audio-transcribe.test.ts:46
import { createAbortReason } from "../../../../util/abort-reasons.js";- Why
- No further detail recorded for this rule.
- Fix
- —
LOWFilesystem / pathfs.traversal · __tests__/extract-keyframes.test.ts:26
mock.module("../../../../persistence/media-store.js", () => ({- Why
- No further detail recorded for this rule.
- Fix
- —
Audit 0.4.1 · source sha 19bc86343b63 · 14 Oct 2026Report an issue or request a re-scan
Provenance
Who published it, and what the verdict is pinned to
- Publishervellum-ai GitHub organizationOwner of the repository this skill is read from
- Source foldervellum-ai/vellum-assistant/assistant/src/config/bundled-skills/media-processingThe exact folder we audited
- LicenceMITAs the repository states it
- Commit pinned for this verdict19bc86343b63A new audit runs when the source changes
- Repository statusNot archivedLast push 1 day ago
- Sandboxed runNot runSkills are read, not executed; layer L4 is skipped
What it tells the agent
Full source on GitHub ↗Its description: Ingest and process media files (video, audio, image)
---
name: media-processing
description: "Ingest and process media files (video, audio, image)"
compatibility: "Designed for Vellum personal assistants"
metadata:
emoji: "🎬"
vellum:
display-name: "Media Processing"
category: "content"
activation-hints:
- "User wants to ingest, process, or analyze a local video, audio, or image file"
- "User wants to ask natural-language questions about a video's content (e.g. 'what happens at 3:14', 'find all the goals', 'who appears in this footage')"
- "User wants to extract a clip or short segment from a video"
- "User wants to run keyframe extraction, segmentation, or frame-by-frame analysis on a video"
avoid-when:
- "User only wants a plain audio transcript — use the transcribe skill instead"
- "User just wants to play or open a media file in their default system player — that does not need this pipeline"
---
Ingest and track processing of media files (video, audio, images) through a configurable 3-phase pipeline.
## End-to-End Workflow
The processing pipeline follows a sequential 3-phase flow:
1. **Ingest** (`ingest_media`) - Register a media file, detect MIME type, extract duration, deduplicate by content hash.
2. **Preprocess** (`extract_keyframes`) - Detect dead time, segment the video into windows, extract downscaled keyframes, build a subject registry, and write a pipeline manifest.
3. **Map** (`analyze_keyframes`) - Send each segment's frames to the configured Gemini vision model with assistant-provided extraction instructions and a JSON Schema for guaranteed structured output. Supports concurrency pooling, cost tracking, resumability, and automatic retries.
4. **Reduce / Query** (`query_media`) - Send all map output to Claude for intelligent analysis and Q&A. Supports arbitrary natural language queries about video content.
5. **Clip** (`generate_clip`) - Extract video clips around specific moments.
The processing pipeline service (`services/processing-pipeline.ts`) orchestrates phases 2-4 automatically with retries, resumability, and cancellation support.
## Tools
### ingest_media
Register a media file for processing. Accepts an absolute file path, validates the file exists, detects MIME type, extracts duration (for video/audio via ffprobe), and registers the asset with content-hash deduplication.
### media_status
Query the processing status of a media asset. Returns the asset metadata along with per-stage progress details. Use this to monitor pipeline progress.
### extract_keyframes
Preprocess a video asset: detect dead time via mpdecimate, segment the video into windows, extract downscaled keyframes at regular intervals, build a subject registry, and write a pipeline manifest.
Parameters:
- `asset_id` (required) - ID of the media asset.
- `interval_seconds` - Interval between keyframes (default: 1s). Use 0.5s for sports/action content where frame density matters.
- `segment_duration` - Duration of each segment window (default: 15s).
- `dead_time_threshold` - Sensitivity for dead-time detection (default: 0.02).
- `section_config` - Path to a JSON file with manual section boundaries.
- `detect_dead_time` - Whether to detect and skip dead time (default: false). Dead-time detection can be too aggressive for continuous action video like sports - it may incorrectly skip live play. Enable only for content with clear idle periods (e.g., lectures, surveillance footage).
- `short_edge` - Short edge resolution for downscaled frames in pixels (default: 480).
- `include_audio` - Whether to extract and transcribe audio for each segment (default: false). When enabled, each segment's audio is transcribed using the configured STT service and stored alongside visual frames.
### analyze_keyframes
Map video segments through Gemini's structured output API. Supports two modes:
- **`keyframes`** (default) - Reads frames from the preprocess manifest, sends each segment's images to Gemini. Requires `extract_keyframes` to be run first. Best for longer videos (> 1 hour) or when you need fine-grained control over frame selection (interval, segment duration, dead-time skipping).
- **`direct_video`** - Uploads the video file directly to Gemini's Files API. Gemini sees actual motion and temporal context instead of static frames. Best for shorter videos (< 1 hour) where temporal context matters (detecting actions, transitions, motion patterns). Has a 2 GB file size limit. Does not require `extract_keyframes` preprocessing.
Both modes produce the same `MapOutput` format, so `query_media` works identically regardless of which mode was used.
Parameters:
- `asset_id` (required) - ID of the media asset.
- `system_prompt` (required) - Extraction instructions for Gemini.
- `output_schema` (required) - JSON Schema for structured output.
- `mode` - Analysis mode: `'keyframes'` (default) or `'direct_video'`.
- `context` - Additional context to include in the prompt.
- `model` - Gemini model to use (defaults to the Gemini provider's recommended vision model).
- `concurrency` - Maximum concurrent API requests (default: 10, keyframes mode only).
- `max_retries` - Retry attempts per segment on failure (default: 3).
### query_media
Query video analysis data using natural language. Sends map output (from analyze_keyframes) to Claude for intelligent analysis and Q&A. Supports arbitrary questions about video content.
Parameters:
- `asset_id` (required) - ID of the media asset.
- `query` (required) - Natural language query about the video data.
- `system_prompt` - Optional system prompt for Claude.
- `model` - LLM model to use. Defaults to the assistant's active chat model.
### generate_clip
Extract a video clip from a media asset using ffmpeg. Applies configurable pre/post-roll padding (clamped to file boundaries), outputs the clip as a temporary file.
## Services
### Processing Pipeline (services/processing-pipeline.ts)
Orchestrates the full processing pipeline with reliability features:
- **Sequential eExcerpt, first 6,001 characters of SKILL.md, verbatim from the audited commit. It is text from someone else’s repository, quoted so you can judge it before your agent reads it.
Install
Pinned to the audited commit 19bc863
git clone https://github.com/vellum-ai/vellum-assistant git -C vellum-assistant checkout 19bc86343b63
The author documents no install command, so this uses the repository directly. Our verdict covers commit 19bc86343b63 only.
Works in
The author has not said which agents this skill supports, and we have not tested it in any.
Audit history
Every audit, every source change
- ✓SAFE B 89 / 100
first audit · source
19bc86343b63
README badge
For maintainers · shows the latest audit
[](https://modelsatlas.com/skills/vellum-ai/media-processing/)
The badge shows our verdict and grade for this skill, and links back to this page. It changes when the audit does.
Similar skills
All coding & review skills →vellum-ai/vellum-assistant
Set up, authenticate, and run external coding agents (Claude Code, Codex) via the Agent Client Protocol
vellum-ai/vellum-assistant
Shop on Amazon and Amazon Fresh through your browser
vellum-ai/vellum-assistant
Record and analyze API surfaces of web services
vellum-ai/vellum-assistant
Build and edit small, personal visual tools and artifacts — dashboards, trackers, calculators, data visualizations, charts, simple landing pages, and slide decks the user wants for THEMSELVES. This is the right skill…
vellum-ai/vellum-assistant
Drive a specific named macOS app via raw input bypassing the Accessibility tree
vellum-ai/vellum-assistant
Import conversation history from ChatGPT into Vellum
Add this badge to your README
[](https://modelsatlas.com/skills/vellum-ai/media-processing/)
<a href="https://modelsatlas.com/skills/vellum-ai/media-processing/"><img src="https://modelsatlas.com/skills/vellum-ai/media-processing/badge.svg" alt="ModelsAtlas: SAFE B"></a>
Questions about Media Processing
What does the Media Processing skill do?
Is Media Processing safe to install?
What can Media Processing access on my machine?
What do I need installed to use Media Processing?
How current is this page?
Sources
- github.com/vellum-ai/vellum-assistant/tree/main/assistant/src/co — the audited source at commit 19bc86343b63 and every finding aboveObserved · 14 Oct 2026
Spotted something wrong? Report a correction · Methodology
Keep going in your AI
Opens with this page as the source. We add nothing else to the prompt.
- What does the Media Processing skill do?
- Is Media Processing safe to install?
- What can Media Processing access on my machine?