three-body-video-creator

Pass

Audited by Gen Agent Trust Hub on Oct 26, 2026

Risk Level: SAFEDYNAMIC_EXECUTIONDATA_EXFILTRATIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [DYNAMIC_EXECUTION]: The script scripts/voice_generator.py uses sys.path.append to dynamically add a directory to the Python search path based on a relative path (../../temp_qwen3_tts/qwen3-tts-local/scripts) before attempting to import the LocalTTSGenerator module.
  • [DATA_EXFILTRATION]: The scripts/sound_generator.py file performs network operations to https://api.edata.cloud/v1/generate to interface with a music generation service and downloads audio files from remote URLs. While this is part of the skill's primary function (integrating with Suno API), it involves sending data to and downloading content from a non-whitelisted third-party domain.
  • [INDIRECT_PROMPT_INJECTION]: The skill ingests user-provided text and JSON configurations to generate media content, which presents a surface for indirect injection.
  • Ingestion points: Data enters via user requests and JSON input files (--input) passed to the voice and sound generation scripts.
  • Boundary markers: No explicit delimiters or instructions are used to separate untrusted data from processing commands in the provided script logic.
  • Capability inventory: The skill has capabilities for network access (requests), file writing, and media processing using moviepy and opencv.
  • Sanitization: No explicit sanitization or validation of the input text or JSON schema was found in the provided script code.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 26, 2026, 10:52 AM