gbro-collage-broll
Pass
Audited by Gen Agent Trust Hub on Oct 23, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill uses
subprocess.runwithin its Python scripts to invoke system tools such asffmpegfor video manipulation (stripping audio, creating contact sheets) andgcloudfor file synchronization. These calls are well-defined, use specific arguments, and target local or project-defined paths. - [INDIRECT_PROMPT_INJECTION]: The skill processes user-provided voiceover scripts and abstract concepts to generate prompts for image and video models. While it lacks explicit input sanitization markers, the mandatory 3-gate human approval workflow serves as a strong control, requiring user confirmation of the visual metaphor and still frames before any video generation occurs.
- [EXTERNAL_DOWNLOADS]: The
generate_video.pyscript includes a mechanism to download generated video content from the Google Gemini Files API. This operation is performed using standard libraries (urllib.request) and targets authenticated Google API endpoints (generativelanguage.googleapis.com).
Audit Metadata