reel
Pass
Audited by Gen Agent Trust Hub on Oct 6, 2026
Risk Level: SAFE
Full Analysis
- [CREDENTIALS_UNSAFE]: The skill follows security best practices for secret management. It explicitly instructs users to store the ElevenLabs API key in a local
.envfile and provides a.env.exemplotemplate. TheSKILL.mdcontains clear warnings: 'Never ask the person to paste the key in the chat' and 'Scripts never print the value'. Thescripts/_comum.mjsutility reads secrets from the environment or local file without logging them. - [COMMAND_EXECUTION]: The skill uses
ffmpegvia Node.jsspawnSyncinscripts/mixar.mjsto process audio files. Arguments are passed as an array to prevent shell injection, and the tool is used for its intended purpose (leveling volume and applying fades). - [EXTERNAL_DOWNLOADS]: The skill communicates with the ElevenLabs API (
https://api.elevenlabs.io) to generate narration and fetches fonts from Google Fonts (https://fonts.googleapis.com) during the video rendering process. These are legitimate operations required for the skill's stated functionality. - [DYNAMIC_EXECUTION]: The skill utilizes the Remotion framework to render videos. It generates a
cenas.jsonconfiguration file which is then processed by React components to produce the final MP4 output. This is a standard and safe implementation for local video generation.
Audit Metadata