guided-music-video

Pass

Audited by Gen Agent Trust Hub on Oct 28, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill facilitates the installation and execution of external software packages required for audio processing and video rendering.
  • Node.js: Executes @helios-project/cli via npx to perform video verification, frame-sheet generation, and final rendering.
  • Python: Recommends installing demucs for audio stem separation and stable-ts or stable-whisper for lyric alignment.
  • [DYNAMIC_EXECUTION]: The skill uses dynamic generation of logic and scripts to define media timelines and alignment.
  • It provides templates for generating JavaScript logic (SCENES array) that maps song beats to visual scenes.
  • It includes a Python script (align.py) designed to be generated or used by the agent to create timing metadata (lyrics.json).
  • [INDIRECT_PROMPT_INJECTION]: The skill parses user-supplied text and JSON data (lyrics and timing cues) which represents an attack surface for indirect instructions.
  • Ingestion points: Processes lyrics.txt and lyrics.json files from the local filesystem during the alignment and rendering phases.
  • Boundary markers: The instructions do not define specific delimiters or instructions to ignore embedded commands within the lyric text.
  • Capability inventory: The skill has access to shell execution (npx, ffmpeg, pip) and file system writes.
  • Sanitization: Lyric content is used for display and timing logic as raw string data without explicit sanitization for escape characters or control sequences.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 28, 2026, 01:45 AM