huashu-design
Pass
Audited by Gen Agent Trust Hub on Aug 14, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSDATA_EXFILTRATION
Full Analysis
- [COMMAND_EXECUTION]: The skill's core workflow involves executing local system commands to process media. Shell scripts and Node.js/Python utilities orchestrate the use of FFmpeg, ffprobe, and Playwright to render HTML designs into production-ready formats like MP4, PDF, and editable PPTX files.
- [EXTERNAL_DOWNLOADS]: The skill interacts with external domains to retrieve media assets and web resources. It uses a Python script to download public-domain imagery from Wikimedia Commons and references standard CDNs and Google Fonts within its HTML templates for font rendering and library support.
- [DATA_EXFILTRATION]: Optional cloud features send data to external services for processing. Rendered video segments and narration text are transmitted to official ByteDance (Volcengine) APIs to perform AI-assisted video review and text-to-speech synthesis. These cloud-touching operations are clearly declared and protected by an explicit consent gate requiring the user to pass a confirmation flag.
Audit Metadata