reel

Pass

Audited by Gen Agent Trust Hub on Oct 6, 2026

Risk Level: SAFE
Full Analysis
  • [CREDENTIALS_UNSAFE]: The skill follows security best practices for secret management. It explicitly instructs users to store the ElevenLabs API key in a local .env file and provides a .env.exemplo template. The SKILL.md contains clear warnings: 'Never ask the person to paste the key in the chat' and 'Scripts never print the value'. The scripts/_comum.mjs utility reads secrets from the environment or local file without logging them.
  • [COMMAND_EXECUTION]: The skill uses ffmpeg via Node.js spawnSync in scripts/mixar.mjs to process audio files. Arguments are passed as an array to prevent shell injection, and the tool is used for its intended purpose (leveling volume and applying fades).
  • [EXTERNAL_DOWNLOADS]: The skill communicates with the ElevenLabs API (https://api.elevenlabs.io) to generate narration and fetches fonts from Google Fonts (https://fonts.googleapis.com) during the video rendering process. These are legitimate operations required for the skill's stated functionality.
  • [DYNAMIC_EXECUTION]: The skill utilizes the Remotion framework to render videos. It generates a cenas.json configuration file which is then processed by React components to produce the final MP4 output. This is a standard and safe implementation for local video generation.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 6, 2026, 11:48 PM