three-body-video-creator
Pass
Audited by Gen Agent Trust Hub on Oct 26, 2026
Risk Level: SAFEDYNAMIC_EXECUTIONDATA_EXFILTRATIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [DYNAMIC_EXECUTION]: The script
scripts/voice_generator.pyusessys.path.appendto dynamically add a directory to the Python search path based on a relative path (../../temp_qwen3_tts/qwen3-tts-local/scripts) before attempting to import theLocalTTSGeneratormodule. - [DATA_EXFILTRATION]: The
scripts/sound_generator.pyfile performs network operations tohttps://api.edata.cloud/v1/generateto interface with a music generation service and downloads audio files from remote URLs. While this is part of the skill's primary function (integrating with Suno API), it involves sending data to and downloading content from a non-whitelisted third-party domain. - [INDIRECT_PROMPT_INJECTION]: The skill ingests user-provided text and JSON configurations to generate media content, which presents a surface for indirect injection.
- Ingestion points: Data enters via user requests and JSON input files (
--input) passed to the voice and sound generation scripts. - Boundary markers: No explicit delimiters or instructions are used to separate untrusted data from processing commands in the provided script logic.
- Capability inventory: The skill has capabilities for network access (
requests), file writing, and media processing usingmoviepyandopencv. - Sanitization: No explicit sanitization or validation of the input text or JSON schema was found in the provided script code.
Audit Metadata