virtual-singer-mv-script

Pass

Audited by Gen Agent Trust Hub on Sep 30, 2026

Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
  • [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted text (lyrics) and audio metadata, which are used to generate storyboard content and visual prompts for video generation models.
  • Ingestion points: Untrusted data enters the skill via the lyrics text input and audio file paths defined in SKILL.md and processed by scripts/lyrics-parser.py.
  • Boundary markers: The skill does not implement delimiters or safety instructions in the output JSON or Markdown files to prevent downstream AI models from following instructions potentially embedded within the processed lyrics.
  • Capability inventory: The skill utilizes shell command execution (running its internal Python scripts), file system read/write operations (e.g., in scripts/merge-output.py), and generates prompts intended to be consumed by other AI models (such as Kling, Sora, or Veo).
  • Sanitization: There is no evidence of sanitization or content filtering for the lyrics before they are integrated into the final script outputs.
  • [COMMAND_EXECUTION]: The skill's workflow relies on executing local Python scripts to perform audio analysis and data processing tasks.
  • Evidence: SKILL.md specifies the use of python3 scripts/audio-analyzer.py, scripts/lyrics-parser.py, and scripts/scene-assigner.py within the local environment to generate the final MV storyboard.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 30, 2026, 09:17 PM