product-video-creator
Pass
Audited by Gen Agent Trust Hub on Jul 27, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
- [SAFE]: The skill instructions and associated scripts do not contain any evidence of malicious intent, obfuscation, data exfiltration, or persistence mechanisms.
- [COMMAND_EXECUTION]: The skill utilizes a local Python script (
scripts/video_composer.py) to synthesize video files. This script uses themoviepylibrary to process local image and audio files based on configuration data. The script is invoked using standard shell commands with well-defined parameters and operates entirely within the local environment. - [EXTERNAL_DOWNLOADS]: The skill defines dependencies on standard, well-known Python packages including
moviepy,pillow, andopencv-python. These are established libraries for media processing and are sourced from official package registries. - [PROMPT_INJECTION]: The skill ingests untrusted user input (product information and video requirements) which is then used by sub-agents to generate creative content. This creates an indirect prompt injection surface. Ingestion points: Step 1 in
SKILL.md(processes product info). Boundary markers: Not present. Capability inventory: Local file writing and video synthesis viamoviepyinscripts/video_composer.py. Sanitization: Not present. Given the functional necessity of processing user input for video creation and the lack of high-risk capabilities, this surface is considered low risk.
Audit Metadata