lyric-music-video

Pass

Audited by Gen Agent Trust Hub on Sep 28, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTIONREMOTE_CODE_EXECUTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill automates the retrieval of project assets from public repositories. The scripts/fetch-fonts.sh utility downloads open-source fonts from the official Google Fonts repository on GitHub. Additionally, scripts/new-project.sh clones the base rendering engine from its primary open-source repository. These downloads are standard for the tool's setup phase.
  • [COMMAND_EXECUTION]: Shell scripts are utilized to orchestrate the video production lifecycle, including project scaffolding, parallelized rendering via Chromium, and image generation using the codex CLI. These commands are focused on media creation and are transparent in their implementation.
  • [DYNAMIC_EXECUTION]: The skill generates and executes TypeScript scene modules which define the visual behavior of the music video. This dynamic code generation is a core feature of the procedural rendering pipeline and operates on locally created assets.
  • [INDIRECT_PROMPT_INJECTION]: The skill ingests user-provided lyrics and stylistic descriptions to form prompts for image generation. Although this represents a potential injection vector for image generators, the skill incorporates explicit manual quality assurance requirements, as detailed in the references/art.md and references/qa.md files, to mitigate the risk of unintended output.
  • [REMOTE_CODE_EXECUTION]: During initial setup, the new-project.sh script runs bun install to resolve and download project dependencies. To maintain security and stability, the skill pins its main external dependency to a specific commit hash, ensuring that the local environment is initialized against a verified version of the upstream code.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 28, 2026, 06:03 PM