video-to-template

Fail

Audited by Gen Agent Trust Hub on Oct 26, 2026

Risk Level: HIGHCOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill extensively uses the subprocess module to execute system commands for media manipulation and web interaction.
  • Evidence includes calls to ffmpeg and ffprobe in scripts/analyze.py and scripts/compare.py to extract video metadata, detect scene cuts, and generate side-by-side comparisons.
  • The skill invokes chromium-browser (via scripts/lib.mjs and scripts/framesmith/media.py) to capture web UI screenshots and rasterize SVG icons.
  • [EXTERNAL_DOWNLOADS]: The skill performs network operations to fetch data from various remote endpoints:
  • Communicates with OpenAI's API (api.openai.com) for Text-to-Speech (TTS), Whisper transcription, and DALL-E image generation.
  • Fetches icons and configuration data from well-known CDNs and repositories, including cdn.jsdelivr.net for Lucide icons and raw.githubusercontent.com for the thesvg.org icon registry.
  • Downloads reference videos and crawls websites based on user-provided URLs in scripts/analyze.py and scripts/grab.mjs.
  • [INDIRECT_PROMPT_INJECTION]: The skill possesses a surface for indirect prompt injection as it ingests untrusted external data that influences downstream AI logic.
  • Ingestion points: scripts/analyze.py captures video transcripts via Whisper, and scripts/grab.mjs extracts text from live websites.
  • Capability inventory: The extracted text is passed to the no-ai-slop editing tool and the framesmith engine to generate scripts and on-screen copy.
  • Sanitization: While the skill implements some basic filename sanitization, it relies on the LLM's internal guardrails when processing potentially adversarial content within transcripts or scraped web text.
  • [DYNAMIC_EXECUTION]: The scripts/scaffold.py script dynamically generates a new Python CLI (main.py) using a string template. This is a standard scaffolding pattern used to initialize new video templates with timing and metadata derived from the analyzed reference video.
Recommendations
  • HIGH: Downloads and executes remote code from: unknown (check file) - DO NOT USE without thorough review
Audit Metadata
Risk Level
HIGH
Analyzed
Oct 26, 2026, 10:19 AM