video-podcast-maker
Pass
Audited by Gen Agent Trust Hub on Jun 12, 2026
Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill uses shell command execution and dynamic module loading to perform its video processing tasks.
- Multiple utility scripts (generate_tts.py, learn_design.py, verify_output.py, generate_shorts.py) invoke subprocesses to run ffmpeg and ffprobe for media extraction and metadata probing.
- The skill executes npx remotion via subprocess to render video compositions and stills.
- scripts/cli.py and scripts/tts/backends/init.py utilize importlib.import_module and import to dynamically load backend modules and command parsers from the project's own directory structure.
- [PROMPT_INJECTION]: The skill's research-oriented workflow possesses a surface for indirect prompt injection.
- Ingestion points: The topic research phase (Step 2) fetches external web content into the agent context, which is then used to generate narration scripts.
- Capability inventory: The skill can write code files and execute shell commands to render videos based on the script generated from research data.
- Boundary markers: The pipeline uses [SECTION:xxx] markers to structure data, but relies on the underlying model's internal safety filters to sanitize instructions found in external research content.
- [EXTERNAL_DOWNLOADS]: Communicates with external services for updates and media synthesis.
- scripts/check_update.sh performs a git ls-remote check against the official repository to identify if a new version is available for the user.
- Various TTS backends (Azure, Doubao, OpenAI, ElevenLabs, Google) send text content to official cloud provider endpoints for audio synthesis.
- templates/components/LottieAnimation.tsx supports fetching After Effects animation JSON data from remote URLs provided in the video configuration.
Audit Metadata