chengfeng-subtitle-talking-head
Pass
Audited by Gen Agent Trust Hub on Aug 1, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill executes several Node.js scripts (e.g.,
ensure-runtime.cjs,videocut-cli.cjs) to manage the subtitle workflow. It dynamically discovers the path to these scripts using thecodexCLI to ensure it interacts with the correct version of thechengfeng-videocutplugin. - [EXTERNAL_DOWNLOADS]: The skill's runtime initialization process includes a mechanism to download and install missing components from GitHub Release. This is a standard update and installation feature for the vendor's ecosystem and targets a well-known service.
- [PROMPT_INJECTION]: The skill ingests external data such as
transcript.json,edit-list.json, and author scripts for word alignment. While this constitutes an indirect prompt injection surface, the skill utilizes specialized CLI tools for processing rather than passing raw untrusted data directly into a conversational prompt, mitigating the risk of subverting agent behavior.
Audit Metadata