product-video-creator
Pass
Audited by Gen Agent Trust Hub on Oct 26, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill directs the agent to execute a provided local script
scripts/video_composer.pyto synthesize the final video product. This script is used as a technical utility to merge images, audio, and subtitle configurations into an MP4 file using the moviepy library. - [INDIRECT_PROMPT_INJECTION]: The skill ingests user-provided product information and creative requirements to drive the video generation process, presenting a surface for indirect prompt injection.
- Ingestion points: User input regarding product details, target audience, and style requirements are ingested during the copywriting and storyboarding steps defined in
SKILL.md. - Boundary markers: The instructions do not define explicit delimiters or warnings to ignore instructions that might be embedded within the user-supplied product descriptions.
- Capability inventory: The skill is capable of reading local media and configuration files and writing an MP4 file to the local filesystem via the
video_composer.pyscript. No network operations are performed. - Sanitization: The instructions do not include steps for sanitizing or validating external product data before it is used to generate prompts for images or subtitles.
Audit Metadata